CVE-2022-4822: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T21:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: setup/lib/main.lib.php
Commit date: 2022-12-25 14:16:25 +0100
Commit message: fixes #176, possible XSS in setup

Diff: diff --git a/setup/lib/main.lib.php b/setup/lib/main.lib.php
index 4d1048a3..712c38f8 100644
--- a/setup/lib/main.lib.php
+++ b/setup/lib/main.lib.php
@@ -93,36 +93,41 @@ function getstep(&$id) {
 
 	return $i;
 }
 
 function validate() {
-	if (!ctype_alnum($_POST ['fpuser']))
-		$err [] = "{$_POST['fpuser']} is not a valid username. 
+	$fpuser = strip_tags($_POST ['fpuser']);
+	$fppwd = $_POST ['fppwd'];
+	$fppwd2 = $_POST ['fppwd2'];
+	$email = strip_tags($_POST ['email']);
+	$www = strip_tags($_POST ['www']);
+	if (!ctype_alnum($fpuser)) {
+		$err [] = $fpuser . " is not a valid username. 
 		Username must be alphanumeric and should not contain spaces.";
-
-	if (strlen(trim(($_POST ['fppwd']))) < 6)
+	}
+	if (strlen(trim(($fppwd))) < 6) {
 		$err [] = "Password must contain at least 6 non-space characters";
-
-	if (($_POST ['fppwd']) != ($_POST ['fppwd2']))
+	}
+	if (($fppwd) != ($fppwd2)) {
 		$err [] = "Passwords did not match";
-
-	if (!(preg_match('!@.*@|\.\.|\,|\;!', $_POST ['email']) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $_POST ['email'])))
-		$err [] = "{$_POST['email']} is not a valid email address";
-
-	$www = $_POST ['www'];
+	}
+	if (!(preg_match('!@.*@|\.\.|\,|\;!', $email) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $email))) {
+		$err [] = $email . " is not a valid email address";
+	}
 	if (!(preg_match('!^http(s)?://[\w-]+\.[\w-]+(\S+)?$!i', $www) || preg_match('!^http(s)?://localhost!', $www)))
-		$err [] = "$www is not a valid URL";
-	if ($www && $www [strlen($www) - 1] != '/')
+		$err [] = $www . " is not a valid URL";
+	if ($www && $www [strlen($www) - 1] != '/') {
 		$www .= '/';
+	}
 
 	global $fp_config;
 
-	$fp_config ['general'] ['author'] = $user ['userid'] = $_POST ['fpuser'];
-	$user ['password'] = $_POST ['fppwd'];
+	$fp_config ['general'] ['author'] = $user ['userid'] = $fpuser;
+	$user ['password'] = $fppwd;
 
 	$fp_config ['general'] ['www'] = $user ['www'] = $www;
-	$fp_config ['general'] ['email'] = $user ['email'] = $_POST ['email'];
+	$fp_config ['general'] ['email'] = $user ['email'] = $email;
 
 	if (isset($err)) {
 		$GLOBALS ['err'] = $err;
 		return false;
 	}

Vulnerable code: 	if (!ctype_alnum($_POST ['fpuser']))
		$err [] = "{$_POST['fpuser']} is not a valid username. 

	if (strlen(trim(($_POST ['fppwd']))) < 6)

	if (($_POST ['fppwd']) != ($_POST ['fppwd2']))

	if (!(preg_match('!@.*@|\.\.|\,|\;!', $_POST ['email']) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $_POST ['email'])))
		$err [] = "{$_POST['email']} is not a valid email address";

	$www = $_POST ['www'];
		$err [] = "$www is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/')
	$fp_config ['general'] ['author'] = $user ['userid'] = $_POST ['fpuser'];
	$user ['password'] = $_POST ['fppwd'];
	$fp_config ['general'] ['email'] = $user ['email'] = $_POST ['email'];
Fixed code: 	$fpuser = strip_tags($_POST ['fpuser']);
	$fppwd = $_POST ['fppwd'];
	$fppwd2 = $_POST ['fppwd2'];
	$email = strip_tags($_POST ['email']);
	$www = strip_tags($_POST ['www']);
	if (!ctype_alnum($fpuser)) {
		$err [] = $fpuser . " is not a valid username. 
	}
	if (strlen(trim(($fppwd))) < 6) {
	}
	if (($fppwd) != ($fppwd2)) {
	}
	if (!(preg_match('!@.*@|\.\.|\,|\;!', $email) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $email))) {
		$err [] = $email . " is not a valid email address";
	}
		$err [] = $www . " is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/') {
	}
	$fp_config ['general'] ['author'] = $user ['userid'] = $fpuser;
	$user ['password'] = $fppwd;
	$fp_config ['general'] ['email'] = $user ['email'] = $email;