CVE-2020-29171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-02-10T15:15Z
Repository: https://github.com/Arsenal21/all-in-one-wordpress-security
Language: PHP
Files changed: all-in-one-wp-security/admin/wp-security-blacklist-menu.php, all-in-one-wp-security/readme.txt, all-in-one-wp-security/wp-security-core.php, all-in-one-wp-security/wp-security.php
Commit date: 2020-12-25 14:51:58 +1100
Commit message: v4.4.6 released
Diff: diff --git a/all-in-one-wp-security/admin/wp-security-blacklist-menu.php b/all-in-one-wp-security/admin/wp-security-blacklist-menu.php
index fadf87f..40cd7a6 100644
--- a/all-in-one-wp-security/admin/wp-security-blacklist-menu.php
+++ b/all-in-one-wp-security/admin/wp-security-blacklist-menu.php
@@ -4,75 +4,75 @@ if(!defined('ABSPATH')){
 }
 
 class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
 {
     var $menu_page_slug = AIOWPSEC_BLACKLIST_MENU_SLUG;
-    
+
     /* Specify all the tabs of this menu in the following array */
     var $menu_tabs;
 
     var $menu_tabs_handler = array(
         'tab1' => 'render_tab1',
         );
-    
-    function __construct() 
+
+    function __construct()
     {
         $this->render_menu_page();
     }
-    
-    function set_menu_tabs() 
+
+    function set_menu_tabs()
     {
         $this->menu_tabs = array(
         'tab1' => __('Ban Users', 'all-in-one-wp-security-and-firewall'),
         );
     }
-    
-    function get_current_tab() 
+
+    function get_current_tab()
     {
         $tab_keys = array_keys($this->menu_tabs);
         $tab = isset( $_GET['tab'] ) ? sanitize_text_field($_GET['tab']) : $tab_keys[0];
         return $tab;
     }
 
     /*
      * Renders our tabs of this menu as nav items
      */
-    function render_menu_tabs() 
+    function render_menu_tabs()
     {
         $current_tab = $this->get_current_tab();
 
         echo '<h2 class="nav-tab-wrapper">';
-        foreach ( $this->menu_tabs as $tab_key => $tab_caption ) 
+        foreach ( $this->menu_tabs as $tab_key => $tab_caption )
         {
             $active = $current_tab == $tab_key ? 'nav-tab-active' : '';
-            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';	
+            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';
         }
         echo '</h2>';
     }
-    
+
     /*
      * The menu rendering goes here
      */
-    function render_menu_page() 
+    function render_menu_page()
     {
         echo '<div class="wrap">';
         echo '<h2>'.__('Blacklist Manager','all-in-one-wp-security-and-firewall').'</h2>';//Interface title
         $this->set_menu_tabs();
         $tab = $this->get_current_tab();
         $this->render_menu_tabs();
-        ?>        
+        ?>
         <div id="poststuff"><div id="post-body">
-        <?php 
+        <?php
         //$tab_keys = array_keys($this->menu_tabs);
         call_user_func(array(&$this, $this->menu_tabs_handler[$tab]));
         ?>
         </div></div>
         </div><!-- end of wrap -->
         <?php
     }
-    
-    function render_tab1() 
+
+    function render_tab1()
     {
         global $aio_wp_security;
         global $aiowps_feature_mgr;
         $result = 1;
         if (isset($_POST['aiowps_save_blacklist_settings']))
@@ -81,11 +81,11 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
             if (!wp_verify_nonce($nonce, 'aiowpsec-blacklist-settings-nonce'))
             {
                 $aio_wp_security->debug_logger->log_debug("Nonce check failed for save blacklist settings!",4);
                 die(__('Nonce check failed for save blacklist settings!','all-in-one-wp-security-and-firewall'));
             }
-            
+
             if (isset($_POST["aiowps_enable_blacklisting"]) && empty($_POST['aiowps_banned_ip_addresses']) && empty($_POST['aiowps_banned_user_agents']))
             {
                 $this->show_msg_error('You must submit at least one IP address or one User Agent value or both!','all-in-one-wp-security-and-firewall');
             }
             else
@@ -106,11 +106,11 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
                     else{
                         $result = -1;
                         $error_msg = $payload[1][0];
                         $this->show_msg_error($error_msg);
                     }
-                    
+
                 }
                 else
                 {
                     $aio_wp_security->configs->set_value('aiowps_banned_ip_addresses',''); //Clear the IP address config value
                 }
@@ -120,19 +120,19 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
                     $result = $result * $this->validate_user_agent_list();
                 }else{
                     //clear the user agent list
                     $aio_wp_security->configs->set_value('aiowps_banned_user_agents','');
                 }
-                
+
                 if ($result == 1)
                 {
                     $aio_wp_security->configs->set_value('aiowps_enable_blacklisting',isset($_POST["aiowps_enable_blacklisting"])?'1':'');
                     $aio_wp_security->configs->save_config(); //Save the configuration
-                    
+
                     //Recalculate points after the feature status/options have been altered
                     $aiowps_feature_mgr->check_feature_status_and_recalculate_points();
-                    
+
                     $this->show_msg_settings_updated();
 
                     $write_result = AIOWPSecurity_Utility_Htaccess::write_to_htaccess(); //now let's write to the .htaccess file
                     if ( !$write_result )
                     {
@@ -169,38 +169,38 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
         <div class="inside">
         <?php
         //Display security info badge
         global $aiowps_feature_mgr;
         $aiowps_feature_mgr->output_feature_details_badge("blacklist-manager-ip-user-agent-blacklisting");
-        ?>    
+        ?>
         <form action="" method="POST">
         <?php wp_nonce_field('aiowpsec-blacklist-settings-nonce'); ?>
         <div class="aio_orange_box">
             <p>
             <?php
             $read_link = '<a href="https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin#advanced_features_note" target="_blank">'.__('must read this message', 'all-in-one-wp-security-and-firewall').'</a>';
             echo sprintf(__('This feature can lock you out of admin if it doesn\'t work correctly on your site. You %s before activating this feature.', 'all-in-one-wp-security-and-firewall'), $read_link);
             ?>
             </p>
-        </div>            
+        </div>
         <table class="form-table">
             <tr valign="top">
                 <th scope="row"><?php _e('Enable IP or User Agent Blacklisting', 'all-in-one-wp-security-and-firewall')?>:</th>
                 <td>
                 <input name="aiowps_enable_blacklisting" type="checkbox"<?php if($aio_wp_security->configs->get_value('aiowps_enable_blacklisting')=='1') echo ' checked="checked"'; ?> value="1"/>
                 <span class="description"><?php _e('Check this if you want to enable the banning (or blacklisting) of selected IP addresses and/or user agents specified in the settings below', 'all-in-one-wp-security-and-firewall'); ?></span>
                 </td>
-            </tr>            
+            </tr>
             <tr valign="top">
                 <th scope="row"><?php _e('Enter IP Addresses:', 'all-in-one-wp-security-and-firewall')?></th>
                 <td>
                     <textarea name="aiowps_banned_ip_addresses" rows="5" cols="50"><?php echo ($result == -1)?htmlspecialchars($_POST['aiowps_banned_ip_addresses']):htmlspecialchars($aio_wp_security->configs->get_value('aiowps_banned_ip_addresses')); ?></textarea>
                     <br />
                     <span class="description"><?php _e('Enter one or more IP addresses or IP ranges.','all-in-one-wp-security-and-firewall');?></span>
                     <span class="aiowps_more_info_anchor"><span class="aiowps_more_info_toggle_char">+</span><span class="aiowps_more_info_toggle_text"><?php _e('More Info', 'all-in-one-wp-security-and-firewall'); ?></span></span>
                     <div class="aiowps_more_info_body">
-                            <?php 
+                            <?php
                             echo '<p class="description">'.__('Each IP address must be on a new line.', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">'.__('To specify an IP range use a wildcard "*" character. Acceptable ways to use wildcards is shown in the examples below:', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">'.__('Example 1: 195.47.89.*', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">'.__('Example 2: 195.47.*.*', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">'.__('Example 3: 195.*.*.*', 'all-in-one-wp-security-and-firewall').'</p>';
@@ -210,17 +210,17 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
                 </td>
             </tr>
             <tr valign="top">
                 <th scope="row"><?php _e('Enter User Agents:', 'all-in-one-wp-security-and-firewall')?></th>
                 <td>
-                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?$_POST['aiowps_banned_user_agents']:$aio_wp_security->configs->get_value('aiowps_banned_user_agents'); ?></textarea>
+                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?htmlspecialchars($_POST['aiowps_banned_user_agents']):htmlspecialchars($aio_wp_security->configs->get_value('aiowps_banned_user_agents')); ?></textarea>
                     <br />
                     <span class="description">
                         <?php _e('Enter one or more user agent strings.','all-in-one-wp-security-and-firewall');?></span>
                     <span class="aiowps_more_info_anchor"><span class="aiowps_more_info_toggle_char">+</span><span class="aiowps_more_info_toggle_text"><?php _e('More Info', 'all-in-one-wp-security-and-firewall'); ?></span></span>
                     <div class="aiowps_more_info_body">
-                            <?php 
+                            <?php
                             echo '<p class="description">'.__('Each user agent string must be on a new line.', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">'.__('Example 1 - A single user agent string to block:', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">SquigglebotBot</p>';
                             echo '<p class="description">'.__('Example 2 - A list of more than 1 user agent strings to block', 'all-in-one-wp-security-and-firewall').'</p>';
                             echo '<p class="description">baiduspider<br />SquigglebotBot<br />SurveyBot<br />VoidEYE<br />webcrawl.net<br />YottaShopping_Bot</p>';
@@ -233,34 +233,34 @@ class AIOWPSecurity_Blacklist_Menu extends AIOWPSecurity_Admin_Menu
         <input type="submit" name="aiowps_save_blacklist_settings" value="<?php _e('Save Settings', 'all-in-one-wp-security-and-firewall')?>" class="button-primary" />
         </form>
         </div></div>
         <?php
     }
-    
+
     function validate_user_agent_list()
     {
         global $aio_wp_security;
         @ini_set('auto_detect_line_endings', true);
         //$errors = '';
 
         $submitted_agents = explode(PHP_EOL, $_POST['aiowps_banned_user_agents']);
 	$agents = array();
-	if (!empty($submitted_agents)) 
+	if (!empty($submitted_agents))
         {
             foreach ($submitted_agents as $agent)
             {
                 $text = sanitize_text_field($agent);
                 $agents[] = $text;
             }
         }
-        
+
         if (sizeof($agents) > 1)
         {
             sort( $agents );
             $agents = array_unique($agents, SORT_STRING);
         }
-        
+
         $banned_user_agent_data = implode(PHP_EOL, $agents);
         $aio_wp_security->configs->set_value('aiowps_banned_user_agents',$banned_user_agent_data);
         $_POST['aiowps_banned_user_agents'] = ''; //Clear the post variable for the banned address list
         return 1;
     }
diff --git a/all-in-one-wp-security/readme.txt b/all-in-one-wp-security/readme.txt
index 5f580c9..a0755cf 100644
--- a/all-in-one-wp-security/readme.txt
+++ b/all-in-one-wp-security/readme.txt
@@ -2,11 +2,11 @@
 Contributors: Tips and Tricks HQ, wpsolutions, Peter Petreski, Ruhul Amin, mbrsolution
 Donate link: https://www.tipsandtricks-hq.com
 Tags: security, secure, Anti Virus, antivirus, ban, ban hacker, virus, firewall, firewall security, login, lockdown, htaccess, hack, malware, vulnerability, protect, protection, phishing, database, backup, plugin, sql injection, ssl, restrict, login captcha, bot, hotlink, 404 detection, admin, rename, all in one, scan, scanner, iframe,
 Requires at least: 5.0
 Tested up to: 5.6
-Stable tag: 4.4.5
+Stable tag: 4.4.6
 License: GPLv3
 
 A comprehensive, user-friendly, all in one WordPress security and firewall plugin for your site.
 
 == Privacy Policy ==
@@ -182,10 +182,13 @@ https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin
 == Upgrade Notice ==
 None
 
 == Changelog ==
 
+= 4.4.6 =
+- Fixed potential vulnerability with the Banned User Agents feature (in the blacklist menu).
+
 = 4.4.5 =
 - Fixed default DateTime to prevent DB error.
 - Added Korean language translation files. Thanks to Jonghyun Cho.
 - Reworked the code for the "Generate New DB Table Prefix" feature to make it more robust. Thanks to @baddiedev.
 - Added translation ability to some strings.  
diff --git a/all-in-one-wp-security/wp-security-core.php b/all-in-one-wp-security/wp-security-core.php
index e035f6b..d4cbec7 100644
--- a/all-in-one-wp-security/wp-security-core.php
+++ b/all-in-one-wp-security/wp-security-core.php
@@ -5,11 +5,11 @@ if ( !defined('ABSPATH') ) {
 }
 
 if (!class_exists('AIO_WP_Security')){
 
 class AIO_WP_Security{
-    var $version = '4.4.5';
+    var $version = '4.4.6';
     var $db_version = '1.9';
     var $plugin_url;
     var $plugin_path;
     var $configs;
     var $admin_init;
diff --git a/all-in-one-wp-security/wp-security.php b/all-in-one-wp-security/wp-security.php
index 74eae64..cb7f0f0 100644
--- a/all-in-one-wp-security/wp-security.php
+++ b/all-in-one-wp-security/wp-security.php
@@ -1,9 +1,9 @@
 <?php
 /*
 Plugin Name: All In One WP Security
-Version: 4.4.5
+Version: 4.4.6
 Plugin URI: https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin
 Author: Tips and Tricks HQ, Peter Petreski, Ruhul, Ivy
 Author URI: https://www.tipsandtricks-hq.com/
 Description: All round best WordPress security plugin!
 Text Domain: all-in-one-wp-security-and-firewall

Vulnerable code:     
    
    function __construct() 
    
    function set_menu_tabs() 
    
    function get_current_tab() 
    function render_menu_tabs() 
        foreach ( $this->menu_tabs as $tab_key => $tab_caption ) 
            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';	
    
    function render_menu_page() 
        ?>        
        <?php 
    
    function render_tab1() 
            
                    
                
                    
                    
        ?>    
        </div>            
            </tr>            
                            <?php 
                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?$_POST['aiowps_banned_user_agents']:$aio_wp_security->configs->get_value('aiowps_banned_user_agents'); ?></textarea>
                            <?php 
    
	if (!empty($submitted_agents)) 
        
        
Stable tag: 4.4.5
    var $version = '4.4.5';
Version: 4.4.5
Fixed code: 

    function __construct()

    function set_menu_tabs()

    function get_current_tab()
    function render_menu_tabs()
        foreach ( $this->menu_tabs as $tab_key => $tab_caption )
            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';

    function render_menu_page()
        ?>
        <?php

    function render_tab1()





        ?>
        </div>
            </tr>
                            <?php
                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?htmlspecialchars($_POST['aiowps_banned_user_agents']):htmlspecialchars($aio_wp_security->configs->get_value('aiowps_banned_user_agents')); ?></textarea>
                            <?php

	if (!empty($submitted_agents))


Stable tag: 4.4.6
= 4.4.6 =
- Fixed potential vulnerability with the Banned User Agents feature (in the blacklist menu).

    var $version = '4.4.6';
Version: 4.4.6