CVE-2020-25797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-12-31T18:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/views/admin/token/tokenform.php
Commit date: 2019-12-19 16:15:41 +0100
Commit message: Fixed issue #15680: LimeSurvey 3.21.1 Cross Site Scripting Stored

Diff: diff --git a/application/views/admin/token/tokenform.php b/application/views/admin/token/tokenform.php
index 7cf5d6bcc55..97b40d7ccce 100644
--- a/application/views/admin/token/tokenform.php
+++ b/application/views/admin/token/tokenform.php
@@ -145,19 +145,25 @@ foreach ($tokendata as $Key => $Value) {
             <div class="form-group">
                 <label class=" control-label" for='firstname'>
                 <?php eT("First name:"); ?>
                 </label>
                 <div class="">
-                <input class='form-control' type='text' size='30' id='firstname' name='firstname' value="<?php if (isset($firstname)) {echo $firstname; } ?>" />
+                    <?=TbHtml::textField('firstname', $firstname, [
+                        'class' => 'form-control',
+                        'size' => '30',
+                    ]);?>
                 </div>
             </div>
             <div class="form-group">
                 <label class=" control-label" for='lastname'>
                 <?php eT("Last name:"); ?>
                 </label>
                 <div class="">
-                <input class='form-control' type='text' size='30' id='lastname' name='lastname' value="<?php if (isset($lastname)) {echo $lastname; } ?>" />
+                    <?=TbHtml::textField('lastname', $lastname, [
+                        'class' => 'form-control',
+                        'size' => '30',
+                    ]);?>
                 </div>
             </div>
 
 
             <!-- Token, language -->
@@ -187,21 +193,30 @@ foreach ($tokendata as $Key => $Value) {
             <div class="form-group">
             <label class=" control-label" for='email'>
                 <?php eT("Email:"); ?>
             </label>
             <div class="">
-                <input class='form-control' type='text' maxlength='320' size='50' id='email' name='email' value="<?php if (isset($email)) {echo $email; } ?>" />
+                <?=TbHtml::emailField('email', $email, [
+                        'class' => 'form-control',
+                        'size' => '50',
+                        'maxlength' => '320' 
+                ]);?>
             </div>
             </div>
 
             <!-- Email Status -->
             <div class="form-group">
             <label class=" control-label" for='emailstatus'>
                 <?php eT("Email status:"); ?>
             </label>
             <div class="">
-                <input class='form-control' type='text' maxlength='320' size='50' id='emailstatus' name='emailstatus' placeholder='OK' value="<?php if (isset($emailstatus)) {echo $emailstatus; } else {echo " OK "; }?>" />
+                <?=TbHtml::textField('emailstatus', $emailstatus, [
+                        'class' => 'form-control',
+                        'size' => '50',
+                        'maxlength' => '320',
+                        'placeholder' => 'OK'
+                ]);?>
             </div>
             </div>
 
             <!-- Invitation sent, Reminder sent -->
             <div class="form-group">

Vulnerable code:                 <input class='form-control' type='text' size='30' id='firstname' name='firstname' value="<?php if (isset($firstname)) {echo $firstname; } ?>" />
                <input class='form-control' type='text' size='30' id='lastname' name='lastname' value="<?php if (isset($lastname)) {echo $lastname; } ?>" />
                <input class='form-control' type='text' maxlength='320' size='50' id='email' name='email' value="<?php if (isset($email)) {echo $email; } ?>" />
                <input class='form-control' type='text' maxlength='320' size='50' id='emailstatus' name='emailstatus' placeholder='OK' value="<?php if (isset($emailstatus)) {echo $emailstatus; } else {echo " OK "; }?>" />
Fixed code:                     <?=TbHtml::textField('firstname', $firstname, [
                        'class' => 'form-control',
                        'size' => '30',
                    ]);?>
                    <?=TbHtml::textField('lastname', $lastname, [
                        'class' => 'form-control',
                        'size' => '30',
                    ]);?>
                <?=TbHtml::emailField('email', $email, [
                        'class' => 'form-control',
                        'size' => '50',
                        'maxlength' => '320' 
                ]);?>
                <?=TbHtml::textField('emailstatus', $emailstatus, [
                        'class' => 'form-control',
                        'size' => '50',
                        'maxlength' => '320',
                        'placeholder' => 'OK'
                ]);?>