CVE-2018-19993: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-01-03T19:29Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/public/notice.php
Commit date: 2018-12-22 16:59:30 +0100
Commit message: FIX CVE-2018-19993
Diff: diff --git a/htdocs/public/notice.php b/htdocs/public/notice.php
index 623baa2020a0..6a55411ae3b6 100644
--- a/htdocs/public/notice.php
+++ b/htdocs/public/notice.php
@@ -1,7 +1,7 @@
 <?php
-/* Copyright (C) 2016	Laurent Destailleur		<eldy@users.sourceforge.net>
+/* Copyright (C) 2016-2018	Laurent Destailleur		<eldy@users.sourceforge.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
@@ -17,34 +17,34 @@
 
 /**
  *	\file       htdocs/public/notice.php
  *	\brief      Dolibarr page to show a notice.
  *              Default notice is a message to say network connection is off.
- *              You can also call this page with URL: 
+ *              You can also call this page with URL:
  *                /public/notice.php?lang=xx_XX&transkey=translation_key  (key must be inside file main.lang, error.lang or other.lang)
  *                /public/notice.php?transphrase=url_encoded_sentence_to_show
  */
 
 define('NOCSRFCHECK',1);
-define('NOLOGIN',1);		
+define('NOLOGIN',1);
 
 require '../main.inc.php';
 
 
 /**
  * View
  */
 
-if (! GETPOST('transkey') && ! GETPOST('transphrase'))
+if (! GETPOST('transkey','alphanohtml') && ! GETPOST('transphrase','alphanohtml'))
 {
     print 'Sorry, it seems your internet connexion is off.<br>';
     print 'You need to be connected to network to use this software.<br>';
 }
 else
 {
     $langs->load("error");
     $langs->load("other");
-    
-    if (GETPOST('transphrase')) print GETPOST('transphrase'); 
-    if (GETPOST('transkey')) print $langs->trans(GETPOST('transkey'));
+
+    if (GETPOST('transphrase','alphanohtml')) print GETPOST('transphrase','alphanohtml');
+    if (GETPOST('transkey','alphanohtml')) print $langs->trans(GETPOST('transkey','alphanohtml'));
 }
 

Vulnerable code: /* Copyright (C) 2016	Laurent Destailleur		<eldy@users.sourceforge.net>
 *              You can also call this page with URL: 
define('NOLOGIN',1);		
if (! GETPOST('transkey') && ! GETPOST('transphrase'))
    
    if (GETPOST('transphrase')) print GETPOST('transphrase'); 
    if (GETPOST('transkey')) print $langs->trans(GETPOST('transkey'));
Fixed code: /* Copyright (C) 2016-2018	Laurent Destailleur		<eldy@users.sourceforge.net>
 *              You can also call this page with URL:
define('NOLOGIN',1);
if (! GETPOST('transkey','alphanohtml') && ! GETPOST('transphrase','alphanohtml'))

    if (GETPOST('transphrase','alphanohtml')) print GETPOST('transphrase','alphanohtml');
    if (GETPOST('transkey','alphanohtml')) print $langs->trans(GETPOST('transkey','alphanohtml'));