CVE-2022-1163: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-30T07:15Z
Repository: https://github.com/mineweb/minewebcms
Language: Other
Files changed: app/View/Navbar/admin_add.ctp, app/View/Navbar/admin_edit.ctp
Commit date: 2022-03-08 12:22:29 +0100
Commit message: improv. fix xss with navbar

Diff: diff --git a/app/View/Navbar/admin_add.ctp b/app/View/Navbar/admin_add.ctp
index 65f3eb0..f7d72c1 100755
--- a/app/View/Navbar/admin_add.ctp
+++ b/app/View/Navbar/admin_add.ctp
@@ -222,13 +222,13 @@
             var urls = $('.url_of_nav').serialize();
             urls = urls.split('&');
             url = {};
             for (var key in test = names) {
                 var l = test[key].split('=');
-                l = l[1];
+                l = decodeURIComponent(l[1]);
                 var p = urls[key].split('=');
-                p = p[1];
+                p = decodeURIComponent(p[1]);
                 url[l] = p;
             }
         }
 
         var inputs = {};
diff --git a/app/View/Navbar/admin_edit.ctp b/app/View/Navbar/admin_edit.ctp
index 8f63706..6775f83 100755
--- a/app/View/Navbar/admin_edit.ctp
+++ b/app/View/Navbar/admin_edit.ctp
@@ -94,16 +94,16 @@
                                     ?>
                                     <div class="card card-body" id="nav-<?= $i ?>">
                                         <div class="form-group">
                                             <label><?= $Lang->get('NAVBAR__LINK_NAME') ?></label>
                                             <input type="text" class="form-control name_of_nav"
-                                                   value="<?= urldecode($name) ?>" name="name_of_nav">
+                                                   value="<?= $name ?>" name="name_of_nav">
                                         </div>
                                         <div class="form-group">
                                             <label><?= $Lang->get('URL') ?></label>
                                             <input type="text" class="form-control url_of_nav"
-                                                   value="<?= urldecode($url) ?>"
+                                                   value="<?= $url ?>"
                                                    placeholder="<?= $Lang->get('NAVBAR__CUSTOM_URL') ?>" name="url">
                                         </div>
                                         <a href="#"
                                            class="btn btn-danger delete-nav float-right"><?= $Lang->get('GLOBAL__DELETE') ?></a>
                                         <br>
@@ -236,13 +236,13 @@
             var urls = $('.url_of_nav').serialize();
             urls = urls.split('&');
             url = {};
             for (var key in test = names) {
                 var l = test[key].split('=');
-                l = l[1];
+                l = decodeURIComponent(l[1]);
                 var p = urls[key].split('=');
-                p = p[1];
+                p = decodeURIComponent(p[1]);
                 url[l] = p;
             }
         }
 
         var inputs = {};

Vulnerable code:                 l = l[1];
                p = p[1];
                                                   value="<?= urldecode($name) ?>" name="name_of_nav">
                                                   value="<?= urldecode($url) ?>"
                l = l[1];
                p = p[1];
Fixed code:                 l = decodeURIComponent(l[1]);
                p = decodeURIComponent(p[1]);
                                                   value="<?= $name ?>" name="name_of_nav">
                                                   value="<?= $url ?>"
                l = decodeURIComponent(l[1]);
                p = decodeURIComponent(p[1]);