CVE-2023-39518: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1.0.3 have a stored cross-site scripting vulnerability. The problem is patched in v1.0.3.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-08T19:15Z
Repository: https://github.com/fobybus/social-media-skeleton
Language: PHP
Files changed: admin/atask/add.php, admin/atask/setting.php, signup.php
Commit date: 2023-08-07 01:42:28 +0300
Commit message: Fix XSS issue (#4)

* Fix XSS issue

* Fix Stored XSS
Diff: diff --git a/admin/atask/add.php b/admin/atask/add.php
index 362729d..012d0ce 100644
--- a/admin/atask/add.php
+++ b/admin/atask/add.php
@@ -4,12 +4,12 @@ session_start();
 if(!isset($_SESSION["aid"]))
 {
 	header("location:adminlogin.html");
    exit();
 }
-$uemail=$_POST["email"];
-$upass=$_POST["password"];
+$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
+$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
 //if empty password or username!
 //alt isempty
 if($uemail=="" || $upass=="")
 {
   header("location:add.html");
diff --git a/admin/atask/setting.php b/admin/atask/setting.php
index 5a6c2e6..cf9c7ed 100644
--- a/admin/atask/setting.php
+++ b/admin/atask/setting.php
@@ -19,22 +19,22 @@ if($_SERVER['REQUEST_METHOD'] == 'POST')
 
 	//is email changed 
 	if(isset($_POST['email']))
 	{
 	$echanged=true;
-	$newemail=$_POST['email'];
+	$newemail=htmlspecialchars($_POST['email'], ENT_QUOTES, 'UTF-8');
 	} 
 	//is pass ^^
 	if(isset($_POST['password']))
 	{
 	$pchanged=true;
-	$newpass=$_POST['password'];
+	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
 	} 
 	if(isset($_POST['oldpass']))
 	{
 		$putold=true;
-		$oldpass=$_POST['oldpass'];
+		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
 
 	}
 /*************************************************** */
 // SQLi prevention through parameterization
 $id = $_SESSION["aid"];
diff --git a/signup.php b/signup.php
index 3a40cc7..5258c56 100644
--- a/signup.php
+++ b/signup.php
@@ -1,16 +1,16 @@
 <?php
 include("tasks/condb.php");
 //handle the form 
-$uemail=$_POST["email"];
-$upass=$_POST["password"];
-$ufname=$_POST["fname"];
-$ulname=$_POST["lname"];
-$ugender=$_POST['gender'];
-$ubdate=$_POST['bdate'];
-$uelevel=$_POST['elevel'];
-$ucity=$_POST['city'];
+$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
+$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
+$ufname=htmlspecialchars($_POST["fname"], ENT_QUOTES, 'UTF-8');
+$ulname=htmlspecialchars($_POST["lname"], ENT_QUOTES, 'UTF-8');
+$ugender=htmlspecialchars($_POST['gender'], ENT_QUOTES, 'UTF-8');
+$ubdate=htmlspecialchars($_POST['bdate'], ENT_QUOTES, 'UTF-8');
+$uelevel=htmlspecialchars($_POST['elevel'], ENT_QUOTES, 'UTF-8');
+$ucity=htmlspecialchars($_POST['city'], ENT_QUOTES, 'UTF-8');
 
 //prevent sql injection here 
 $uemail=mysqli_real_escape_string($dbcon,$uemail);
 $upass=mysqli_real_escape_string($dbcon,$upass);
 $ufname=mysqli_real_escape_string($dbcon,$ufname);

Vulnerable code: $uemail=$_POST["email"];
$upass=$_POST["password"];
	$newemail=$_POST['email'];
	$newpass=$_POST['password'];
		$oldpass=$_POST['oldpass'];
$uemail=$_POST["email"];
$upass=$_POST["password"];
$ufname=$_POST["fname"];
$ulname=$_POST["lname"];
$ugender=$_POST['gender'];
$ubdate=$_POST['bdate'];
$uelevel=$_POST['elevel'];
$ucity=$_POST['city'];
Fixed code: $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
	$newemail=htmlspecialchars($_POST['email'], ENT_QUOTES, 'UTF-8');
	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
$ufname=htmlspecialchars($_POST["fname"], ENT_QUOTES, 'UTF-8');
$ulname=htmlspecialchars($_POST["lname"], ENT_QUOTES, 'UTF-8');
$ugender=htmlspecialchars($_POST['gender'], ENT_QUOTES, 'UTF-8');
$ubdate=htmlspecialchars($_POST['bdate'], ENT_QUOTES, 'UTF-8');
$uelevel=htmlspecialchars($_POST['elevel'], ENT_QUOTES, 'UTF-8');
$ucity=htmlspecialchars($_POST['city'], ENT_QUOTES, 'UTF-8');