CVE-2014-125100: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-02T02:15Z
Repository: https://github.com/wp-plugins/job-board
Language: PHP
Files changed: bws_menu/bws_menu.php, job-board.php, readme.txt
Commit date: 2014-08-08 06:25:43 +0000
Commit message: V1.0.1 - Security Exploit was fixed.

git-svn-id: https://plugins.svn.wordpress.org/job-board/trunk@962207 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/bws_menu/bws_menu.php b/bws_menu/bws_menu.php
index 922c3e0..826ee44 100755
--- a/bws_menu/bws_menu.php
+++ b/bws_menu/bws_menu.php
@@ -1,9 +1,9 @@
 <?php
 /*
 * Function for displaying BestWebSoft menu
-* Version: 1.3.6
+* Version: 1.3.7
 */
 
 if ( ! function_exists( 'bws_add_menu_render' ) ) {
 	function bws_add_menu_render() {
 		global $wpdb, $wpmu, $wp_version, $bws_plugin_info;
@@ -513,12 +513,12 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 		}
 
 		if ( ( isset( $_REQUEST['bwsmn_form_submit'] ) && check_admin_referer( plugin_basename(__FILE__), 'bwsmn_nonce_submit' ) ) ||
 			 ( isset( $_REQUEST['bwsmn_form_submit_custom_email'] ) && check_admin_referer( plugin_basename(__FILE__), 'bwsmn_nonce_submit_custom_email' ) ) ) {
 			if ( isset( $_REQUEST['bwsmn_form_email'] ) ) {
-				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
-				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
+				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
+				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
 					$error = __( "Please enter a valid email address.", 'bestwebsoft' );
 				} else {
 					$email = $bwsmn_form_email;
 					$bwsmn_form_email = '';
 					$message = __( 'Email with system info is sent to ', 'bestwebsoft' ) . $email;			
@@ -536,23 +536,28 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 				<h4>Environment</h4>
 				<table>';
 				foreach ( $system_info['system_info'] as $key => $value ) {
 					$message_text .= '<tr><td>'. $key .'</td><td>'. $value .'</td></tr>';	
 				}
-				$message_text .= '</table>
-				<h4>Active Plugins</h4>
-				<table>';
-				foreach ( $system_info['active_plugins'] as $key => $value ) {	
-					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
+				$message_text .= '</table>';
+				if ( ! empty( $system_info['active_plugins'] ) ) {
+					$message_text .= '<h4>Active Plugins</h4>
+					<table>';
+					foreach ( $system_info['active_plugins'] as $key => $value ) {	
+						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
+					}
+					$message_text .= '</table>';
 				}
-				$message_text .= '</table>
-				<h4>Inactive Plugins</h4>
-				<table>';
-				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
-					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
+				if ( ! empty( $system_info['inactive_plugins'] ) ) {
+					$message_text .= '<h4>Inactive Plugins</h4>
+					<table>';
+					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
+						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
+					}
+					$message_text .= '</table>';
 				}
-				$message_text .= '</table></body></html>';
+				$message_text .= '</body></html>';
 				$result = wp_mail( $email, 'System Info From ' . $home_url, $message_text, $headers );
 				if ( $result != true )
 					$error = __( "Sorry, email message could not be delivered.", 'bestwebsoft' );
 			}
 		} ?>
@@ -896,16 +901,18 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 						</tbody>
 					</table>
 					<table class="bws_system_info">
 						<thead><tr><th><?php _e( 'Active Plugins', 'bestwebsoft' ); ?></th><th></th></tr></thead>
 						<tbody>
-						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
-							<tr>
-								<td scope="row"><?php echo $key; ?></td>
-								<td scope="row"><?php echo $value; ?></td>
-							</tr>	
-						<?php } ?>
+						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
+							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
+								<tr>
+									<td scope="row"><?php echo $key; ?></td>
+									<td scope="row"><?php echo $value; ?></td>
+								</tr>	
+							<?php }
+						} ?>
 						</tbody>
 					</table>
 					<table class="bws_system_info">
 						<thead><tr><th><?php _e( 'Inactive Plugins', 'bestwebsoft' ); ?></th><th></th></tr></thead>
 						<tbody>
diff --git a/job-board.php b/job-board.php
index 97d5aae..05397a3 100644
--- a/job-board.php
+++ b/job-board.php
@@ -2,11 +2,11 @@
 /*
 Plugin Name: Job board
 Plugin URI: http://bestwebsoft.com/plugin/
 Description: Plugin for adding to site possibility to create job offers page with custom search, send CV and subscribing for similar jobs.
 Author: BestWebSoft
-Version: 1.0.0
+Version: 1.0.1
 Author URI: http://bestwebsoft.com/
 License: GPLv3 or later
 */
 
 /*
@@ -620,11 +620,11 @@ if ( ! function_exists( 'jbbrd_settings_page' ) ) {
 			else
 				$jbbrd_options['location_select'] = 0;
 
 			/* Set time period unit. */
 			if ( ( isset( $_POST['vacancy_reply_text'] ) ) && ( '' != $_POST['vacancy_reply_text'] ) )
-				$jbbrd_options['vacancy_reply_text'] = $_POST['vacancy_reply_text'];
+				$jbbrd_options['vacancy_reply_text'] = stripslashes( esc_html( $_POST['vacancy_reply_text'] ) );
 
 			/* Set archieving period. */
 			if ( ( isset( $_POST['archieving_period'] ) ) && ( '' != $_POST['archieving_period'] ) && ( is_numeric( $_POST['archieving_period'] ) ) )
 				$jbbrd_options['archieving_period'] = esc_html( floor( $_POST['archieving_period'] ) );
 
@@ -1574,11 +1574,11 @@ if ( ! function_exists( 'jbbrd_save_post' ) ) {
 			/* Loop through the POST data. */
 			foreach ( $jbbrd_meta_fields as $key ) {
 				if ( isset( $_POST[ $key ] ) ) {
 					/* Change date format if fild is 'expiry_date'. */
 					if ( $key == 'expiry_date' ) {
-						$date_compl = $_POST[ $key ];
+						$date_compl = stripslashes( esc_html( $_POST[ $key ] ) );
 						/* Set 30 days period if date field is empty. */
 						if ( '' == $date_compl ) {
 							$jbbrd_default_time = $jbbrd_options['archieving_period'];
 							//$jbbrd_default_time = 30;
 							$date_compl 		= get_the_date( 'U' );
@@ -1589,11 +1589,11 @@ if ( ! function_exists( 'jbbrd_save_post' ) ) {
 							$date_compl			= explode( "/", $date_compl );
 							$format 			= 'Y-m-d 23:59:59';
 							$value				= date( $format, strtotime( $date_compl[1] . "-" . $date_compl[0] . '-' . $date_compl[2] ) );
 						}
 					} else {
-						$value =  $_POST[ $key ];
+						$value =  stripslashes( esc_html( $_POST[ $key ] ) );
 					}
 				} else {
 					$value = '';
 				}
 				/* Delete meta if empty. */
diff --git a/readme.txt b/readme.txt
index 25352fa..f27fce8 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,12 +1,12 @@
 === Job board ===
 Contributors: bestwebsoft
 Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=1&product_id=94
 Tags: plugin, wordpress, jobs, vacancy, job-manager, job-board, job, job offer, job bord, djob board, dgob bord, CV, upload CV, add job offer, apply for a job, vacancy application, job candidate role, manage vacancies, job offer list, save search conditions, job offer categories, search by job category, search by salary, search by organization, post job offer, vacancy archive.  
 Requires at least: 3.5
-Tested up to: 3.9.1
-Stable tag: 1.0.0
+Tested up to: 3.9.2
+Stable tag: 1.0.1
 License: GPLv3 or later
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
 The plugin allows to create a job-board page on your site.
 
@@ -113,13 +113,19 @@ Please make sure that the problem hasn't been discussed yet on our forum (<a hre
 9. Job candidate chosen category offers by last day on profile page screen.
 10. Registration form in widget area.
 
 == Changelog ==
 
+= V1.0.1 - 08.08.2014 =
+* Bugfix : Security Exploit was fixed.
+
 = V1.0.0 - 18.07.2014 = 
 * Bugfix : Login/registration form bugs were fixed.
 * Bugfix : Session bugs were fixed.
 
 == Upgrade Notice ==
 
+= V1.0.1 =
+Security Exploit was fixed.
+
 = V1.0.0 =
-Login/registration form bugs were fixed. Session bugs were fixed.
\ No newline at end of file
+Login/registration form bugs were fixed. Session bugs were fixed.

Vulnerable code: * Version: 1.3.6
				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
				$message_text .= '</table>
				<h4>Active Plugins</h4>
				<table>';
				foreach ( $system_info['active_plugins'] as $key => $value ) {	
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
				$message_text .= '</table>
				<h4>Inactive Plugins</h4>
				<table>';
				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
				$message_text .= '</table></body></html>';
						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
							<tr>
								<td scope="row"><?php echo $key; ?></td>
								<td scope="row"><?php echo $value; ?></td>
							</tr>	
						<?php } ?>
Version: 1.0.0
				$jbbrd_options['vacancy_reply_text'] = $_POST['vacancy_reply_text'];
						$date_compl = $_POST[ $key ];
						$value =  $_POST[ $key ];
Tested up to: 3.9.1
Stable tag: 1.0.0
Login/registration form bugs were fixed. Session bugs were fixed.
Fixed code: * Version: 1.3.7
				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
				$message_text .= '</table>';
				if ( ! empty( $system_info['active_plugins'] ) ) {
					$message_text .= '<h4>Active Plugins</h4>
					<table>';
					foreach ( $system_info['active_plugins'] as $key => $value ) {	
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
					}
					$message_text .= '</table>';
				if ( ! empty( $system_info['inactive_plugins'] ) ) {
					$message_text .= '<h4>Inactive Plugins</h4>
					<table>';
					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
					}
					$message_text .= '</table>';
				$message_text .= '</body></html>';
						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
								<tr>
									<td scope="row"><?php echo $key; ?></td>
									<td scope="row"><?php echo $value; ?></td>
								</tr>	
							<?php }
						} ?>
Version: 1.0.1
				$jbbrd_options['vacancy_reply_text'] = stripslashes( esc_html( $_POST['vacancy_reply_text'] ) );
						$date_compl = stripslashes( esc_html( $_POST[ $key ] ) );
						$value =  stripslashes( esc_html( $_POST[ $key ] ) );
Tested up to: 3.9.2
Stable tag: 1.0.1
= V1.0.1 - 08.08.2014 =
* Bugfix : Security Exploit was fixed.

= V1.0.1 =
Security Exploit was fixed.

Login/registration form bugs were fixed. Session bugs were fixed.