CVE-2011-4341: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages.  NOTE: some of these details are obtained from third party information.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-02-12T22:55Z
Repository: https://github.com/symphonycms/symphony-2
Language: PHP
Files changed: symphony/content/content.publish.php, symphony/lib/toolkit/class.devkit.php
Commit date: 2011-10-01 12:19:43 +1000
Commit message: Fix potential security holes reported by Mavituna Security.

Diff: diff --git a/symphony/content/content.publish.php b/symphony/content/content.publish.php
index bc56499..6808f97 100644
--- a/symphony/content/content.publish.php
+++ b/symphony/content/content.publish.php
@@ -73,19 +73,19 @@
 				} else {
 					$filters = $_REQUEST['filter'];
 				}
 
 				foreach($filters as $handle => $value) {
-
-					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf(
-						"SELECT `f`.`id`
-						FROM `tbl_fields` AS `f`, `tbl_sections` AS `s`
-						WHERE `s`.`id` = `f`.`parent_section`
-						AND f.`element_name` = '%s'
+					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf("
+						SELECT `f`.`id`
+						FROM `tbl_fields` AS `f`
+						LEFT JOIN `tbl_sections` AS `s` ON (`s`.`id` = `f`.`parent_section`)
+						WHERE f.`element_name` = '%s'
 						AND `s`.`handle` = '%s'
-						LIMIT 1",
-						$handle,
+						LIMIT 1
+					",
+						Symphony::Database()->cleanValue($handle),
 						$section->get('handle'))
 					);
 
 					$field = $entryManager->fieldManager->fetch($field_id);
 
@@ -96,11 +96,10 @@
 						$filter_querystring .= sprintf("filter[%s]=%s&amp;", $handle, rawurlencode($value));
 						$prepopulate_querystring .= sprintf("prepopulate[%d]=%s&amp;", $field_id, rawurlencode($value));
 					} else {
 						unset($filters[$i]);
 					}
-
 				}
 
 				$filter_querystring = preg_replace("/&amp;$/", '', $filter_querystring);
 				$prepopulate_querystring = preg_replace("/&amp;$/", '', $prepopulate_querystring);
 
diff --git a/symphony/lib/toolkit/class.devkit.php b/symphony/lib/toolkit/class.devkit.php
index e7068f4..5a45dd0 100644
--- a/symphony/lib/toolkit/class.devkit.php
+++ b/symphony/lib/toolkit/class.devkit.php
@@ -256,10 +256,11 @@
 		 * @see toolkit.HTMLPage#generate()
 		 * @return string
 		 */
 		public function build() {
 			$this->buildIncludes();
+			$this->_view = General::sanitize($this->_view);
 
 			$header = new XMLElement('div');
 			$header->setAttribute('id', 'header');
 			$jump = new XMLElement('div');
 			$jump->setAttribute('id', 'jump');

Vulnerable code: 
					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf(
						"SELECT `f`.`id`
						FROM `tbl_fields` AS `f`, `tbl_sections` AS `s`
						WHERE `s`.`id` = `f`.`parent_section`
						AND f.`element_name` = '%s'
						LIMIT 1",
						$handle,

Fixed code: 					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf("
						SELECT `f`.`id`
						FROM `tbl_fields` AS `f`
						LEFT JOIN `tbl_sections` AS `s` ON (`s`.`id` = `f`.`parent_section`)
						WHERE f.`element_name` = '%s'
						LIMIT 1
					",
						Symphony::Database()->cleanValue($handle),
			$this->_view = General::sanitize($this->_view);