CVE-2020-26134: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-10-02T09:15Z
Repository: https://github.com/LiveHelperChat/livehelperchat
Language: PHP
Files changed: lhc_web/lib/core/lhbbcode/lhbbcode.php, lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
Commit date: 2020-09-28 01:28:18 -0400
Commit message: Cleanup BB Code

Diff: diff --git a/lhc_web/lib/core/lhbbcode/lhbbcode.php b/lhc_web/lib/core/lhbbcode/lhbbcode.php
index 6ca00609b..597f3d0b7 100644
--- a/lhc_web/lib/core/lhbbcode/lhbbcode.php
+++ b/lhc_web/lib/core/lhbbcode/lhbbcode.php
@@ -615,15 +615,15 @@ class erLhcoreClassBBCode
     	$in = array( 	 '/\[b\](.*?)\[\/b\]/ms',
     					 '/\[i\](.*?)\[\/i\]/ms',
     					 '/\[u\](.*?)\[\/u\]/ms',
     					 '/\[mark\](.*?)\[\/mark\]/ms',
     					 '/\[s\](.*?)\[\/s\]/ms',
-    					 '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
+    					 '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
     					 '/\[list\](.*?)\[\/list\]/ms',
     					 '/\[\*\]\s?(.*?)\n/ms',
-    					 '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
-    					 '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
+    					 '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
+    					 '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
     	);
 
     	// And replace them by...
     	$out = array(	 '<strong>\1</strong>',
     					 '<em>\1</em>',
diff --git a/lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php b/lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
index 7e50e8912..961af4869 100644
--- a/lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
+++ b/lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
@@ -614,15 +614,15 @@ class erLhcoreClassBBCodePlain
         $in = array( 	 '/\[b\](.*?)\[\/b\]/ms',
             '/\[i\](.*?)\[\/i\]/ms',
             '/\[u\](.*?)\[\/u\]/ms',
             '/\[mark\](.*?)\[\/mark\]/ms',
             '/\[s\](.*?)\[\/s\]/ms',
-            '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
+            '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
             '/\[list\](.*?)\[\/list\]/ms',
             '/\[\*\]\s?(.*?)\n/ms',
-            '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
-            '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
+            '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
+            '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
         );
 
         // And replace them by...
         $out = array(	 '\1',
             '\1',

Vulnerable code:     					 '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
    					 '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
    					 '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
            '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
            '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
            '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
Fixed code:     					 '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
    					 '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
    					 '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
            '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
            '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
            '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'