CVE-2014-5018: Other (NVD-CWE-Other)
value: Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-07-21T14:55Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/helpers/common_helper.php, application/helpers/frontend_helper.php
Commit date: 2014-07-02 15:17:41 +0200
Commit message: Fixed issue: Vulnerable parameter on survey resume

Diff: diff --git a/application/helpers/common_helper.php b/application/helpers/common_helper.php
index 3439011e9..00e646c7a 100644
--- a/application/helpers/common_helper.php
+++ b/application/helpers/common_helper.php
@@ -3797,11 +3797,10 @@ function questionAttributes($returnByName=false)
         $qattributes["max_num_of_files"]=array(
         "types"=>"|",
         'category'=>$clang->gT('Other'),
         'sortorder'=>130,
         "inputtype"=>"text",
-        'default'=>'1',
         "help"=>$clang->gT("Maximum number of files that the participant can upload for this question"),
         "caption"=>$clang->gT("Max number of files"));
 
         $qattributes["min_num_of_files"]=array(
         "types"=>"|",
@@ -3881,18 +3880,10 @@ function categorySort($a, $b)
         $result=$a['sortorder']-$b['sortorder'];
     }
     return $result;
 }
 
-// make sure the given string (which comes from a POST or GET variable)
-// is safe to use in MySQL.  This does nothing if gpc_magic_quotes is on.
-function autoEscape($str) {
-    if (!get_magic_quotes_gpc()) {
-        return addslashes ($str);
-    }
-    return $str;
-}
 
 // the opposite of the above: takes a POST or GET variable which may or
 // may not have been 'auto-quoted', and return the *unquoted* version.
 // this is useful when the value is destined for a web page (eg) not
 // a SQL query.
diff --git a/application/helpers/frontend_helper.php b/application/helpers/frontend_helper.php
index 3a49373e4..c80828271 100644
--- a/application/helpers/frontend_helper.php
+++ b/application/helpers/frontend_helper.php
@@ -27,11 +27,11 @@ function loadanswers()
         if (isset($scid)) //Would only come from email
 
         {
             $query .= "AND {{saved_control}}.scid={$scid}\n";
         }
-        $query .="AND {{saved_control}}.identifier = '".autoEscape($_SESSION['survey_'.$surveyid]['holdname'])."' ";
+        $query .="AND {{saved_control}}.identifier = '".Yii::app()->db->quoteValue($_SESSION['survey_'.$surveyid]['holdname'])."' ";
 
         if (in_array(Yii::app()->db->getDriverName(), array('mssql', 'sqlsrv', 'dblib')))
         {
             $query .="AND CAST({{saved_control}}.access_code as varchar(32))= '".md5($_SESSION['survey_'.$surveyid]['holdpass'])."'\n";
         }

Vulnerable code:         'default'=>'1',
// make sure the given string (which comes from a POST or GET variable)
// is safe to use in MySQL.  This does nothing if gpc_magic_quotes is on.
function autoEscape($str) {
    if (!get_magic_quotes_gpc()) {
        return addslashes ($str);
    }
    return $str;
}
        $query .="AND {{saved_control}}.identifier = '".autoEscape($_SESSION['survey_'.$surveyid]['holdname'])."' ";
Fixed code:         $query .="AND {{saved_control}}.identifier = '".Yii::app()->db->quoteValue($_SESSION['survey_'.$surveyid]['holdname'])."' ";