CVE-2019-16173: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-09-09T19:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/core/Survey_Common_Action.php
Commit date: 2019-09-01 16:23:09 +0200
Commit message: Fixed issue: [security] #15204: Reflected XSS vulnerabilities - thanks to J. Greil from  the  SEC  Consult Vulnerability Lab
Dev: disable pseudo params for same param to be different : throw a 403

Diff: diff --git a/application/core/Survey_Common_Action.php b/application/core/Survey_Common_Action.php
index 2a769116ba3..39bebab04d1 100644
--- a/application/core/Survey_Common_Action.php
+++ b/application/core/Survey_Common_Action.php
@@ -104,12 +104,11 @@ class Survey_Common_Action extends CAction
 
         $pseudos = array(
             'id' => 'iId',
             'gid' => 'iGroupId',
             'qid' => 'iQuestionId',
-            /* Unsure we set 'iSurveyId', 'iSurveyID','surveyid' to same final survey id */
-            /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set sid surveyid to 1 */
+            /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set iSurveyId to 1 */
             'sid' => array('iSurveyId', 'iSurveyID', 'surveyid'), // Old link use sid
             'surveyId' => array('iSurveyId', 'iSurveyID', 'surveyid'), // PluginHelper->sidebody : if disable surveyId usage : broke API
             'surveyid' => array('iSurveyId', 'iSurveyID', 'surveyid'),
             'srid' => 'iSurveyResponseId',
             'scid' => 'iSavedControlId',
@@ -126,17 +125,20 @@ class Survey_Common_Action extends CAction
         );
 
         // Foreach pseudo, take the key, if it exists,
         // Populate the values (taken as an array) as keys in params
         // with that key's value in the params
-        // (only if that place is empty)
+        // Chek is 2 params are equal for security issue.
         foreach ($pseudos as $key => $pseudo) {
             if (isset($params[$key])) {
                 $pseudo = (array) $pseudo;
                 foreach ($pseudo as $pseud) {
                     if (empty($params[$pseud])) {
                         $params[$pseud] = $params[$key];
+                    } elseif($params[$pseud] != $params[$key]){
+                        // Throw error about multiple params (and if they are different) #15204
+                        throw new CHttpException(403, sprintf(gT("Invalid parameter %s (%s already set)"),$pseud,$key));
                     }
                 }
             }
         }
 
@@ -284,11 +286,10 @@ class Survey_Common_Action extends CAction
                         break;
 
                         // Output
                     case 'output' :
                         //// TODO : http://goo.gl/ABl5t5
-
                         $content .= $viewUrl;
 
                         if (isset($aViewUrls['afteroutput'])) {
                             $content .= $aViewUrls['afteroutput'];
                         }

Vulnerable code:             /* Unsure we set 'iSurveyId', 'iSurveyID','surveyid' to same final survey id */
            /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set sid surveyid to 1 */
        // (only if that place is empty)

Fixed code:             /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set iSurveyId to 1 */
        // Chek is 2 params are equal for security issue.
                    } elseif($params[$pseud] != $params[$key]){
                        // Throw error about multiple params (and if they are different) #15204
                        throw new CHttpException(403, sprintf(gT("Invalid parameter %s (%s already set)"),$pseud,$key));