CVE-2022-28545: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: FUDforum 3.1.1 is vulnerable to Stored XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-05-06T17:15Z
Repository: https://github.com/fudforum/FUDforum
Language: Other
Files changed: install/forum_data/src/iemail.inc.t
Commit date: 2022-01-14 16:35:38 +0200
Commit message: Fix XSS vulnerability reported by ptsecurity.com (attacker tries to send mail to an administrator
on a server that does not have a mail server configured).

Diff: diff --git a/install/forum_data/src/iemail.inc.t b/install/forum_data/src/iemail.inc.t
index 9cdf738c1..224b2d4e6 100644
--- a/install/forum_data/src/iemail.inc.t
+++ b/install/forum_data/src/iemail.inc.t
@@ -1,8 +1,8 @@
 <?php
 /**
-* copyright            : (C) 2001-2021 Advanced Internet Designs Inc.
+* copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
 * email                : forum@prohost.org
 * $Id$
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -36,10 +36,17 @@ function validate_email($email)
 	}
 }
 
 function encode_subject($text)
 {
+	/* HTML entities check. */
+	if (strpos($subj, '&') !== false) {
+		$subj = html_entity_decode($subj);
+	}
+
+	$text = htmlspecialchars($text);  // Prevent XSS like <img src="1" onerror="alert()">
+	
 	if (preg_match('![\x7f-\xff]!', $text)) {
 		$text = '=?{TEMPLATE: iemail_CHARSET}?B?'. base64_encode($text) .'?=';
 	}
 
 	return $text;
@@ -49,30 +56,25 @@ function send_email($from, $to, $subj, $body, $header='', $munge_newlines=1)
 {
 	if (empty($to)) {
 		return 0;
 	}
 
-	/* HTML entities check. */
-	if (strpos($subj, '&') !== false) {
-		$subj = html_entity_decode($subj);
-	}
-
 	if ($header) {
 		$header = "\n" . str_replace("\r", '', $header);
 	}
 	$extra_header = '';
 	if (strpos($header, 'MIME-Version') === false) {
 		$extra_header = "\nMIME-Version: 1.0\nContent-Type: text/plain; charset={TEMPLATE: iemail_CHARSET}\nContent-Transfer-Encoding: 8bit". $header;
 	}
 	$addronly = preg_replace('/.*</', '<', $from);	// RFC 2822 Return-Path: <...>
 	$header = 'From: '. $from ."\nReturn-Path: ". $addronly ."\nUser-Agent: FUDforum/". $GLOBALS['FORUM_VERSION'] . $extra_header . $header;
 
+	$subj = encode_subject($subj);
 	$body = str_replace("\r", '', $body);
 	if ($munge_newlines) {
 		$body = str_replace('\n', "\n", $body);
 	}
-	$subj = encode_subject($subj);
 
 	// Call PRE mail plugins.
 	if (defined('plugins')) {
 		list($to, $subj, $body, $header) = plugin_call_hook('PRE_MAIL', array($to, $subj, $body, $header));
 	}
@@ -88,11 +90,11 @@ function send_email($from, $to, $subj, $body, $header='', $munge_newlines=1)
 		if (!class_exists('fud_smtp')) {
 			fud_use('smtp.inc');
 		}
 		$smtp = new fud_smtp;
 		$smtp->msg = str_replace(array('\n', "\n."), array("\n", "\n.."), $body);
-		$smtp->subject = encode_subject($subj);
+		$smtp->subject = $subj;
 		$smtp->to = $to;
 		$smtp->from = $from;
 		$smtp->headers = $header;
 		$smtp->send_smtp_email();
 		return 1;

Vulnerable code: * copyright            : (C) 2001-2021 Advanced Internet Designs Inc.
	/* HTML entities check. */
	if (strpos($subj, '&') !== false) {
		$subj = html_entity_decode($subj);
	}

	$subj = encode_subject($subj);
		$smtp->subject = encode_subject($subj);
Fixed code: * copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
	/* HTML entities check. */
	if (strpos($subj, '&') !== false) {
		$subj = html_entity_decode($subj);
	}

	$text = htmlspecialchars($text);  // Prevent XSS like <img src="1" onerror="alert()">
	
	$subj = encode_subject($subj);
		$smtp->subject = $subj;