CVE-2015-4671: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-01-12T19:59Z
Repository: https://github.com/opencart/opencart
Language: PHP
Files changed: upload/catalog/controller/account/address.php
Commit date: 2015-12-17 23:59:08 +0000
Commit message: Fixed low risk XSS issue with user account address edit. Thanks to @robert81 for the find.

Close #3721

Diff: diff --git a/upload/catalog/controller/account/address.php b/upload/catalog/controller/account/address.php
index 1f2cb9216..a84f99fda 100644
--- a/upload/catalog/controller/account/address.php
+++ b/upload/catalog/controller/account/address.php
@@ -423,19 +423,19 @@ class ControllerAccountAddress extends Controller {
 		} else {
 			$data['city'] = '';
 		}
 
 		if (isset($this->request->post['country_id'])) {
-			$data['country_id'] = $this->request->post['country_id'];
+			$data['country_id'] = (int)$this->request->post['country_id'];
 		}  elseif (!empty($address_info)) {
 			$data['country_id'] = $address_info['country_id'];
 		} else {
 			$data['country_id'] = $this->config->get('config_country_id');
 		}
 
 		if (isset($this->request->post['zone_id'])) {
-			$data['zone_id'] = $this->request->post['zone_id'];
+			$data['zone_id'] = (int)$this->request->post['zone_id'];
 		}  elseif (!empty($address_info)) {
 			$data['zone_id'] = $address_info['zone_id'];
 		} else {
 			$data['zone_id'] = '';
 		}
@@ -501,15 +501,15 @@ class ControllerAccountAddress extends Controller {
 
 		if ($country_info && $country_info['postcode_required'] && (utf8_strlen(trim($this->request->post['postcode'])) < 2 || utf8_strlen(trim($this->request->post['postcode'])) > 10)) {
 			$this->error['postcode'] = $this->language->get('error_postcode');
 		}
 
-		if ($this->request->post['country_id'] == '') {
+		if ($this->request->post['country_id'] == '' || !is_int($this->request->post['country_id'])) {
 			$this->error['country'] = $this->language->get('error_country');
 		}
 
-		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '') {
+		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '' || !is_int($this->request->post['zone_id'])) {
 			$this->error['zone'] = $this->language->get('error_zone');
 		}
 
 		// Custom field validation
 		$this->load->model('account/custom_field');

Vulnerable code: 			$data['country_id'] = $this->request->post['country_id'];
			$data['zone_id'] = $this->request->post['zone_id'];
		if ($this->request->post['country_id'] == '') {
		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '') {
Fixed code: 			$data['country_id'] = (int)$this->request->post['country_id'];
			$data['zone_id'] = (int)$this->request->post['zone_id'];
		if ($this->request->post['country_id'] == '' || !is_int($this->request->post['country_id'])) {
		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '' || !is_int($this->request->post['zone_id'])) {