CVE-2016-10508: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-08-31T20:29Z
Repository: https://github.com/JamesHeinrich/phpThumb
Language: PHP
Files changed: demo/phpThumb.demo.showpic.php
Commit date: 2016-04-11 12:58:29 -0400
Commit message: demo.showpic security fix

Sanitize input data to prevent Reflected XSS problems

Diff: diff --git a/demo/phpThumb.demo.showpic.php b/demo/phpThumb.demo.showpic.php
index d24f160..a8d9a9b 100644
--- a/demo/phpThumb.demo.showpic.php
+++ b/demo/phpThumb.demo.showpic.php
@@ -74,62 +74,62 @@ function CrossBrowserResizeInnerWindowTo(newWidth, newHeight) {
 </script>
 
 <script type="text/javascript" src="javascript_api.js"></script>
 
 <?php
-function SafeStripSlashes($string) {
-	return (get_magic_quotes_gpc() ? stripslashes($string) : $string);
-}
 require_once('../phpThumb.config.php');
+$allowedGETparameters = array('src','new','w','h','wp','hp','wl','hl','ws','hs','f','q','sx','sy','sw','sh','zc','bc','bg','bgt','fltr','xto','ra','ar','aoe','far','iar','maxb','hash','md5s','sfn','dpi','sia');
 
 $additionalparameters = array();
 foreach ($_GET as $key => $value) {
+	if (!in_array($key, $allowedGETparameters)) {
+		continue;
+	}
 	if (is_array($value)) {
+		if ($key != 'fltr') {
+			continue;
+		}
 		foreach ($value as $key2 => $value2) {
-			$additionalparameters[] = $key.'[]='.SafeStripSlashes($value2);
+			@$additionalparameters[$key][] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value2);
 		}
 	} else {
-		$additionalparameters[] = $key.'='.SafeStripSlashes($value);
+		$additionalparameters[$key] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value);
 	}
 }
-//$imagesrc = $phpThumbLocation.implode('&', $additionalparameters);
-$imagesrc = phpThumbURL(implode($PHPTHUMB_CONFIG['config_high_security_url_separator'], $additionalparameters), $phpThumbLocation);
+$imagesrc = phpThumbURL($additionalparameters, $phpThumbLocation);
 
 echo '<script type="text/javascript">';
-echo 'var ns4;';
-echo 'var op5;';
-echo 'function setBrowserWindowSizeToImage() {';
-echo 	'if (!document.getElementById("imageimg")) { return false; }';
-echo	'sniffBrowsers();';
-echo 	'var imageW = getImageWidth("imageimg");';
-echo 	'var imageH = getImageHeight("imageimg");';
+echo 'var ns4;'."\n";
+echo 'var op5;'."\n";
+echo 'function setBrowserWindowSizeToImage() {'."\n";
+echo 	'if (!document.getElementById("imageimg")) { return false; }'."\n";
+echo	'sniffBrowsers();'."\n";
+echo 	'var imageW = getImageWidth("imageimg");'."\n";
+echo 	'var imageH = getImageHeight("imageimg");'."\n";
 		// check for maximum dimensions to allow no-scrollbar window
 echo 	'if (((screen.width * 1.1) > imageW) || ((screen.height * 1.1) > imageH)) {'."\n";
 			// screen is large enough to fit whole picture on screen with 10% margin
 echo 		'CrossBrowserResizeInnerWindowTo(imageW, imageH);'."\n";
 echo 	'} else {'."\n";
 			// image is too large for screen: add scrollbars by putting the image inside an IFRAME
-echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (IE, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";';
+echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (Chrome, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";'."\n";
 echo 	'}'."\n";
 echo '}';
 echo '</script>';
-?>
-
-</head>
 
-<body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan"><?php
+echo '</head><body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan">';
 
 if (!empty($_GET['src'])) {
 
 	echo '<script type="text/javascript">';
 	echo 'document.writeln(\'<img src="'.$imagesrc.'" border="0" id="imageimg" hspace="0" hspace="0" style="padding: 0px; margin: 0px;">\');';
 	echo '</script>';
 
 } else {
 
 	echo '<pre>';
-	echo 'Usage:<br><br><b>'.$_SERVER['PHP_SELF'].'?src=<i>filename</i>&title=<i>Picture+Title</i></b>';
+	echo 'Usage:<br><br><b>'.basename(__FILE__).'?src=<i>filename</i>&amp;title=<i>Picture+Title</i></b>';
 	echo '</pre>';
 
 }
 
 ?></div></body>

Vulnerable code: function SafeStripSlashes($string) {
	return (get_magic_quotes_gpc() ? stripslashes($string) : $string);
}
			$additionalparameters[] = $key.'[]='.SafeStripSlashes($value2);
		$additionalparameters[] = $key.'='.SafeStripSlashes($value);
//$imagesrc = $phpThumbLocation.implode('&', $additionalparameters);
$imagesrc = phpThumbURL(implode($PHPTHUMB_CONFIG['config_high_security_url_separator'], $additionalparameters), $phpThumbLocation);
echo 'var ns4;';
echo 'var op5;';
echo 'function setBrowserWindowSizeToImage() {';
echo 	'if (!document.getElementById("imageimg")) { return false; }';
echo	'sniffBrowsers();';
echo 	'var imageW = getImageWidth("imageimg");';
echo 	'var imageH = getImageHeight("imageimg");';
echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (IE, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";';
?>

</head>
<body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan"><?php
	echo 'Usage:<br><br><b>'.$_SERVER['PHP_SELF'].'?src=<i>filename</i>&title=<i>Picture+Title</i></b>';
Fixed code: $allowedGETparameters = array('src','new','w','h','wp','hp','wl','hl','ws','hs','f','q','sx','sy','sw','sh','zc','bc','bg','bgt','fltr','xto','ra','ar','aoe','far','iar','maxb','hash','md5s','sfn','dpi','sia');
	if (!in_array($key, $allowedGETparameters)) {
		continue;
	}
		if ($key != 'fltr') {
			continue;
		}
			@$additionalparameters[$key][] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value2);
		$additionalparameters[$key] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value);
$imagesrc = phpThumbURL($additionalparameters, $phpThumbLocation);
echo 'var ns4;'."\n";
echo 'var op5;'."\n";
echo 'function setBrowserWindowSizeToImage() {'."\n";
echo 	'if (!document.getElementById("imageimg")) { return false; }'."\n";
echo	'sniffBrowsers();'."\n";
echo 	'var imageW = getImageWidth("imageimg");'."\n";
echo 	'var imageH = getImageHeight("imageimg");'."\n";
echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (Chrome, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";'."\n";
echo '</head><body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan">';
	echo 'Usage:<br><br><b>'.basename(__FILE__).'?src=<i>filename</i>&amp;title=<i>Picture+Title</i></b>';