CVE-2012-10007: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-19T16:15Z
Repository: https://github.com/madgicweb/buddystream
Language: PHP
Files changed: buddystream.php, extensions/default/templates/ShareBox.php, readme.txt
Commit date: 2012-12-04 18:38:39 +0000
Commit message: fixed vulnerability

git-svn-id: https://plugins.svn.wordpress.org/buddystream/trunk@634128 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/buddystream.php b/buddystream.php
index f7ca3b4..28993a3 100644
--- a/buddystream.php
+++ b/buddystream.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: BuddyStream
 Plugin URI: http://www.buddystream.net
 Description: BuddyStream
-Version: 2.6.2
+Version: 2.6.3
 Author: Peter Hofman
 Author URI: http://www.buddystream.net
 */
 
 // Copyright (c) 2010/2011/2012 Buddystream.net All rights reserved.
@@ -29,11 +29,11 @@ Author URI: http://www.buddystream.net
 function buddystream_init()
 {
     global $bp;
 
     //define plugin version and installed value
-    define('BP_BUDDYSTREAM_VERSION', '2.6.2');
+    define('BP_BUDDYSTREAM_VERSION', '2.6.3');
     define('BP_BUDDYSTREAM_IS_INSTALLED', 1);
     define('BP_BUDDYSTREAM_DIR', dirname(__FILE__));
     define('BP_BUDDYSTREAM_URL', $bp->root_domain."/".str_replace(ABSPATH,"",dirname(__FILE__)));
 
     //first load translations
diff --git a/extensions/default/templates/ShareBox.php b/extensions/default/templates/ShareBox.php
index d8a27d8..0715eec 100644
--- a/extensions/default/templates/ShareBox.php
+++ b/extensions/default/templates/ShareBox.php
@@ -2,19 +2,19 @@
 <div class="buddystream_sharebox_box">
 <h3>ShareBox</h3>
 <br/>
 
 <blockquote>
-    <h4><i>"<?php echo $_GET['content']; ?>"</i></h4>
+    <h4><i>"<?php echo esc_attr($_GET['content']); ?>"</i></h4>
 </blockquote>
 <br/>
 
 <?php
 
-$content   = $_GET['content'];
-$link      = $_GET['link'];
-$arrShares = explode(',', $_GET['shares']);
+$content   = esc_attr($_GET['content']);
+$link      = esc_attr($_GET['link']);
+$arrShares = explode(',', esc_attr($_GET['shares']));
 
 foreach($arrShares as $share){
 
     if($share == 'facebook'){
         echo '<a href="http://www.facebook.com/share.php?u=' . urlencode($link) . '&t=' . urlencode($content) . '" class="buddystream_sharebutton facebook">Facebook share</a> ';
@@ -24,11 +24,11 @@ foreach($arrShares as $share){
     if($share == 'twitter'){
         echo '<a href="http://twitter.com/home?status=' . urlencode($content) . ' ' . urlencode($link) . '" class="buddystream_sharebutton twitter">Share on Twitter</a> ';
     }
 
     if($share == 'linkedin'){
-        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.$link.'"></script> ';
+        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.urlencode($link).'"></script> ';
     }
 
     if($share == 'googleplus'){
         echo '<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
         <g:plusone size="medium" annotation="none" href="'.$url.'"></g:plusone>
diff --git a/readme.txt b/readme.txt
index 59782c8..55e3417 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === BuddyStream===
 Contributors: Blackphantom
 Tags: Buddypress, Twitter, Facebook, Flickr, Tweetstream, Facestream, Google+, Soundcloud, Rss, Last.fm, Vimeo, LinkedIn, Buddystream, Apollo
 Requires at least: WP 2.9.1, BuddyPress 1.2.3
-Tested up to: WP 3.4.1, BuddyPress 1.6.1
-Stable tag: 2.6.2
+Tested up to: WP 3.4.2, BuddyPress 1.6.1
+Stable tag: 2.6.3
 
 == Released under the GPL license ==
 http://www.opensource.org/licenses/gpl-license.php
 
 == Description ==
@@ -37,10 +37,13 @@ For support and other feature request, please contact us on our website.
 
 == Screenshots ==
 
 == ChangeLog ==
 
+= 2.6.3 =
+* Fixed vulnerability in the ShareBox
+
 = 2.6.2 =
 * Improved check for sending out to networks (now no longer conflicts with plugins like activity hashtags)
 * Small CSS fix for BuddyPress 1.6 support.
 * Fixed stylesheet loading issues
 * Removed highcharts graph script, alternative will be implemented in 3.0

Vulnerable code: Version: 2.6.2
    define('BP_BUDDYSTREAM_VERSION', '2.6.2');
    <h4><i>"<?php echo $_GET['content']; ?>"</i></h4>
$content   = $_GET['content'];
$link      = $_GET['link'];
$arrShares = explode(',', $_GET['shares']);
        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.$link.'"></script> ';
Tested up to: WP 3.4.1, BuddyPress 1.6.1
Stable tag: 2.6.2
Fixed code: Version: 2.6.3
    define('BP_BUDDYSTREAM_VERSION', '2.6.3');
    <h4><i>"<?php echo esc_attr($_GET['content']); ?>"</i></h4>
$content   = esc_attr($_GET['content']);
$link      = esc_attr($_GET['link']);
$arrShares = explode(',', esc_attr($_GET['shares']));
        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.urlencode($link).'"></script> ';
Tested up to: WP 3.4.2, BuddyPress 1.6.1
Stable tag: 2.6.3
= 2.6.3 =
* Fixed vulnerability in the ShareBox