CVE-2022-29710: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-25T01:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/views/admin/pluginmanager/uploadConfirm.php
Commit date: 2022-04-19 11:55:42 +0200
Commit message: Fixed issue: [security] Minor XSS issue in plugin overview - reported by Podalirius (podalirius.net/en/)

Diff: diff --git a/application/views/admin/pluginmanager/uploadConfirm.php b/application/views/admin/pluginmanager/uploadConfirm.php
index 15bfd5a1ed0..5c912c489ef 100644
--- a/application/views/admin/pluginmanager/uploadConfirm.php
+++ b/application/views/admin/pluginmanager/uploadConfirm.php
@@ -1,11 +1,10 @@
 <div class='col-lg-12'>
     <div class='pagetitle h3'><?php eT('Confirm uploaded plugin'); ?></div>
 
     <?php // Only show config summary if config could be found. ?>
-    <?php if (isset($config)): ?>
-
+    <?php if (isset($config)) : ?>
         <?php echo CHtml::form(
             Yii::app()->getController()->createUrl(
                 '/admin/pluginmanager',
                 [
                     'sa'       => 'installUploadedPlugin'
@@ -14,18 +13,18 @@
             'post'
         ); ?>
 
             <input type="hidden" name="isUpdate" value="<?php echo json_encode($isUpdate); ?>" />
 
-            <?php if ($isUpdate): ?>
+            <?php if ($isUpdate) : ?>
                 <div class='alert alert-info'>
                     <p>
                         <i class='fa fa-info'></i>&nbsp;
                         <?php eT('The following plugin will be updated. Please click "Update" to update the plugin, or "Abort" to abort.'); ?>
                     </p>
                 </div>
-            <?php else: ?>
+            <?php else : ?>
                 <div class='alert alert-info'>
                     <p>
                         <i class='fa fa-info'></i>&nbsp;
                         <?php eT('The following plugin will be installed. Please click "Install" to install the plugin, or "Abort" to abort. Aborting will remove the files from the file system.'); ?>
                     </p>
@@ -33,58 +32,57 @@
             <?php endif; ?>
 
             <!-- Name -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"><?php eT("Name:"); ?></label>
-                <div class="col-sm-4"><?php echo $config->getName(); ?></div>
+                <div class="col-sm-4"><?=htmlentities($config->getName()); ?></div>
             </div>
 
             <!-- Description -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"><?php eT("Description:"); ?></label>
-                <div class="col-sm-8"><?php echo $config->getDescription(); ?></div>
+                <div class="col-sm-8"><?=htmlentities($config->getDescription()); ?></div>
             </div>
 
             <!-- Version -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"><?php eT("Version:"); ?></label>
-                <div class="col-sm-4"><?php echo $config->getVersion(); ?></div>
+                <div class="col-sm-4"><?=htmlentities($config->getVersion()); ?></div>
             </div>
 
             <!-- Author -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"><?php eT("Author:"); ?></label>
-                <div class="col-sm-4"><?php echo $config->getAuthor(); ?></div>
+                <div class="col-sm-4"><?=htmlentities($config->getAuthor()); ?></div>
             </div>
 
             <!-- Compatible -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"><?php eT("Compatible"); ?></label>
-                <?php if ($config->isCompatible()): ?>
+                <?php if ($config->isCompatible()) : ?>
                     <div class="col-sm-4"><span class="fa fa-check text-success"></span></div>
-                <?php else: ?>
+                <?php else : ?>
                     <div class="col-sm-4"><span class="fa fa-times text-warning"></span></div>
                 <?php endif; ?>
             </div>
 
             <!-- Buttons -->
             <div class="form-group col-sm-12">
                 <label class="col-sm-4 control-label"></label>
                 <div class="col-sm-4">
-                    <?php if ($isUpdate): ?>
+                    <?php if ($isUpdate) : ?>
                         <input type="submit" class="btn btn-success" value="<?php eT("Update");?>" />
-                    <?php else: ?>
+                    <?php else : ?>
                         <input type="submit" class="btn btn-success" value="<?php eT("Install");?>" />
                     <?php endif; ?>
                     <a href="<?php echo $abortUrl; ?>" class="btn btn-warning" data-dismiss="modal"><?php eT("Abort");?></a>
                 </div>
             </div>
 
         </form>
 
-    <?php else: ?>
-
+    <?php else : ?>
         <div class='alert alert-warning'>
             <p>
             <i class='fa fa-warning'></i>&nbsp;
             <?php eT('Error: Found no configuration for plugin. Please contact the plugin author.'); ?>
             </p>

Vulnerable code:     <?php if (isset($config)): ?>

            <?php if ($isUpdate): ?>
            <?php else: ?>
                <div class="col-sm-4"><?php echo $config->getName(); ?></div>
                <div class="col-sm-8"><?php echo $config->getDescription(); ?></div>
                <div class="col-sm-4"><?php echo $config->getVersion(); ?></div>
                <div class="col-sm-4"><?php echo $config->getAuthor(); ?></div>
                <?php if ($config->isCompatible()): ?>
                <?php else: ?>
                    <?php if ($isUpdate): ?>
                    <?php else: ?>
    <?php else: ?>

Fixed code:     <?php if (isset($config)) : ?>
            <?php if ($isUpdate) : ?>
            <?php else : ?>
                <div class="col-sm-4"><?=htmlentities($config->getName()); ?></div>
                <div class="col-sm-8"><?=htmlentities($config->getDescription()); ?></div>
                <div class="col-sm-4"><?=htmlentities($config->getVersion()); ?></div>
                <div class="col-sm-4"><?=htmlentities($config->getAuthor()); ?></div>
                <?php if ($config->isCompatible()) : ?>
                <?php else : ?>
                    <?php if ($isUpdate) : ?>
                    <?php else : ?>
    <?php else : ?>