CVE-2015-10032: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-09T09:15Z
Repository: https://github.com/StevenElberger/HealthMateWeb
Language: PHP
Files changed: createaccount.php, newaccount.html
Commit date: 2015-02-13 22:36:25 -0800
Commit message: Add XSS prevention to createaccount.php, clean up some code

Diff: diff --git a/createaccount.php b/createaccount.php
index 18b2506..f629078 100644
--- a/createaccount.php
+++ b/createaccount.php
@@ -13,20 +13,43 @@
 	if ($conn->connect_error) {
 		die("Connection failed: " . $conn->connect_error);
 	}
 	
 	// Remove after debug
-	echo "Connected successfully";
+	echo "<p>Connected successfully</p>";
+	
+	// Placeholders for variables from form
+	$username = $password = $first_name = $last_name = $company = $phone = "";
+	
+	// Prevent XSS hacks / exploits by stripping the data
+	if ($_SERVER["REQUEST_METHOD"] == "POST") {
+		$username = test_input($_POST["username"]);
+		$password = test_input($_POST["password"]);
+		$first_name = test_input($_POST["first_name"]);
+		$last_name = test_input($_POST["last_name"]);
+		$company = test_input($_POST["company"]);
+		$phone = test_input($_POST["phone"]);
+	}
+	
+	// Removes unwanted and potentially malicious characters
+	// from the form data
+	function test_input($data) {
+		$data = trim($data);
+		$data = stripslashes($data);
+		$data = htmlspecialchars($data);
+		return $data;
+	}
 	
 	// Adds a new user account with form data into the physician table of the database
-	// -- To do: form checking (e.g., username already exists, etc.)
-	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$_POST['username']."', '".$_POST['password']."', '".$_POST['firstN']."', '".$_POST['lastN']."', '".$_POST['company']."', '".$_POST['phone']."')";
+	// -- To do: form checking (e.g., username already exists, security, etc.)
+	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$username."', '".$password."', '".$first_name."', '".$last_name."', '".$company."', '".$phone."')";
 	
 	// Probably keep even after debug
 	if ($conn->query($sql) === TRUE) {
-		echo "Account created successfully.";
+		echo "<p>Account created successfully.</p>";
 	} else {
 		echo "Error: " . $sql . "<br />" . $conn->error;
 	}
 	
+	// Peace out
 	$conn->close();
 ?>
\ No newline at end of file
diff --git a/newaccount.html b/newaccount.html
index 7cd8fbe..aa5a389 100644
--- a/newaccount.html
+++ b/newaccount.html
@@ -5,12 +5,12 @@
 		<title>Create an Account</title>
 	</head>
 	<body>
 		<h1>HealthMate Physician Login</h1>
 		<form action="createaccount.php" method="post">
-		<p>First name: <input type="text" name="firstN" size="16" maxlength="16" /></p>
-		<p>Last name: <input type="text" name="lastN" size="16" maxlength="16" /></p>
+		<p>First name: <input type="text" name="first_name" size="16" maxlength="16" /></p>
+		<p>Last name: <input type="text" name="last_name" size="16" maxlength="16" /></p>
 		<p>Username: <input type="text" name="username" size="16" maxlength="16" /></p>
 		<p>Password: <input type="password" name="password" size="16" maxlength="16" /></p>
 		<p>Confirm Password: <input type="password" name="confirm" size="16" maxlength="16" /></p>
 		<p>Company: <input type="text" name="company" size="16" maxlength="16" /></p>
 		<p>Phone Number: <input type="text" name="phone" size="16" maxlength="16" /></p>

Vulnerable code: 	echo "Connected successfully";
	// -- To do: form checking (e.g., username already exists, etc.)
	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$_POST['username']."', '".$_POST['password']."', '".$_POST['firstN']."', '".$_POST['lastN']."', '".$_POST['company']."', '".$_POST['phone']."')";
		echo "Account created successfully.";
		<p>First name: <input type="text" name="firstN" size="16" maxlength="16" /></p>
		<p>Last name: <input type="text" name="lastN" size="16" maxlength="16" /></p>
Fixed code: 	echo "<p>Connected successfully</p>";
	
	// Placeholders for variables from form
	$username = $password = $first_name = $last_name = $company = $phone = "";
	
	// Prevent XSS hacks / exploits by stripping the data
	if ($_SERVER["REQUEST_METHOD"] == "POST") {
		$username = test_input($_POST["username"]);
		$password = test_input($_POST["password"]);
		$first_name = test_input($_POST["first_name"]);
		$last_name = test_input($_POST["last_name"]);
		$company = test_input($_POST["company"]);
		$phone = test_input($_POST["phone"]);
	}
	
	// Removes unwanted and potentially malicious characters
	// from the form data
	function test_input($data) {
		$data = trim($data);
		$data = stripslashes($data);
		$data = htmlspecialchars($data);
		return $data;
	}
	// -- To do: form checking (e.g., username already exists, security, etc.)
	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$username."', '".$password."', '".$first_name."', '".$last_name."', '".$company."', '".$phone."')";
		echo "<p>Account created successfully.</p>";
	// Peace out
		<p>First name: <input type="text" name="first_name" size="16" maxlength="16" /></p>
		<p>Last name: <input type="text" name="last_name" size="16" maxlength="16" /></p>