CVE-2023-44379: Insufficient Information (NVD-CWE-noinfo)
value: baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-22T15:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: plugins/BcColumn/templates/element/site_search_form.php, plugins/bc-front/templates/plugin/BcSearchIndex/SearchIndexes/search.php
Commit date: 2024-02-22 15:20:39 +0900
Commit message: Merge pull request from GHSA-66c2-p8rh-qx87


Diff: diff --git a/plugins/BcColumn/templates/element/site_search_form.php b/plugins/BcColumn/templates/element/site_search_form.php
index 6d308f4b5b9..4f4c1d3ca36 100755
--- a/plugins/BcColumn/templates/element/site_search_form.php
+++ b/plugins/BcColumn/templates/element/site_search_form.php
@@ -14,10 +14,10 @@ if(!isset($searchIndexesFront)) $searchIndexesFront = null;
 ?>
 
 
 <div class="section search-box">
 	<?php echo $this->BcForm->create($searchIndexesFront, array('type' => 'get', 'url' => $url)) ?>
-	<?php echo $this->BcForm->control('q', ['escape' => false]) ?>
+	<?php echo $this->BcForm->control('q') ?>
 	<?php echo $this->BcForm->hidden('site_id', ['value' => $this->getRequest()->getAttribute('currentSite')->id]) ?>
 	<?php echo $this->BcForm->submit('検索', array('div' => false, 'class' => 'submit_button bs-button')) ?>
 	<?php echo $this->BcForm->end() ?>
 </div>
diff --git a/plugins/bc-front/templates/plugin/BcSearchIndex/SearchIndexes/search.php b/plugins/bc-front/templates/plugin/BcSearchIndex/SearchIndexes/search.php
index 41e770caf77..5163b4205a2 100755
--- a/plugins/bc-front/templates/plugin/BcSearchIndex/SearchIndexes/search.php
+++ b/plugins/bc-front/templates/plugin/BcSearchIndex/SearchIndexes/search.php
@@ -30,11 +30,11 @@ $this->BcBaser->setTitle(__d('baser_core', '検索結果一覧'));
 <div class="bs-search-form">
     <?php echo $this->BcBaser->createForm($searchIndexesFront, ['type' => 'get']) ?>
     <?php if ($contentFolders): ?>
         <?php echo $this->BcBaser->formControl('f', ['type' => 'select', 'options' => $contentFolders, 'empty' => __d('baser_core', 'カテゴリ')]) ?>
     <?php endif ?>
-    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'escape' => false, 'div' => false]) ?>
+    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'div' => false]) ?>
     <?php echo $this->BcBaser->formHidden('s') ?>
     <?php echo $this->BcBaser->formSubmit(__d('baser_core', '検索'), ['div' => false, 'class' => 'bs-button-small']) ?>
     <?php echo $this->BcBaser->endForm() ?>
 </div>
 

Vulnerable code: 	<?php echo $this->BcForm->control('q', ['escape' => false]) ?>
    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'escape' => false, 'div' => false]) ?>
Fixed code: 	<?php echo $this->BcForm->control('q') ?>
    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'div' => false]) ?>