CVE-2012-10014: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-24T18:15Z
Repository: https://github.com/wp-plugins/kau-boys-backend-localization
Language: Other
Files changed: backend_localization.php, readme.txt
Commit date: 2012-07-31 19:41:35 +0000
Commit message: Adding version 2.0: Fixing shown language in the switching message. Use htmlspecialchars() to prevent XSS vulnerabilities. Thanks again to Matt Fuller for teaching me how to do it correctly!

git-svn-id: https://plugins.svn.wordpress.org/kau-boys-backend-localization/trunk@579938 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/backend_localization.php b/backend_localization.php
index 4858a2b..a773b5e 100644
--- a/backend_localization.php
+++ b/backend_localization.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: Backend Localization
 Plugin URI: http://kau-boys.com/230/wordpress/kau-boys-backend-localization-plugin
 Description: This plugin enables you to run your blog in a different language than the backend of your blog. So you can serve your blog using e.g. German as the default language for the users, but keep English as the language for the administration.
-Version: 2.0
+Version: 2.1
 Requires at least: 3.2
 Author: Bernhard Kau
 Author URI: http://kau-boys.com
 */
 
@@ -173,20 +173,20 @@ function backend_localization_admin_settings(){
 	}
 	$loginselect = get_option( 'kau-boys_backend_localization_loginselect' );
 	
 	$backend_locale = backend_localization_get_locale();
 	
+	// set default if values haven't been recieved from the database
+	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
+	
 	// do redirection for dashboard from the qTranslate Plugin (www.qianqin.de/qtranslate)
 	if(isset($_GET['godashboard'])) {
 		echo '<h2>' . __( 'Switching Language', 'backend-localization' ) . '</h2>'
-			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$locale_value], admin_url() )
+			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$backend_locale], admin_url() )
 			. '<script type="text/javascript">document.location="' . admin_url() . '";</script>';
 		exit();
 	}
-	
-	// set default if values haven't been recieved from the database
-	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
 ?>
 
 <div class="wrap">
 	<?php screen_icon(); ?>
 	<h2>Kau-Boy's Backend Localization</h2>
@@ -253,11 +253,11 @@ function backend_localization_get_languages(){
 	return $backend_locale_array;
 }
 
 function backend_localization_save_setting(){
 	if( isset( $_REQUEST['kau-boys_backend_localization_language'] ) ){
-		setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
+		setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
 	}
 	
 	return true;
 }
 
@@ -285,11 +285,11 @@ function backend_localization_login_form(){
 <?php
 }
 
 function backend_localization_get_locale(){
 	return 	isset( $_REQUEST['kau-boys_backend_localization_language'] )
-			? backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] )
+			? htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] )
 			: (	isset( $_COOKIE['kau-boys_backend_localization_language'] )
 				? $_COOKIE['kau-boys_backend_localization_language']
 				: get_option( 'kau-boys_backend_localization_language' ) );
 }
 
@@ -301,15 +301,11 @@ function localize_backend($locale){
 	return $locale;
 }
 
 function backend_localization_set_login_language(){
 	setcookie( 'kau-boys_backend_localization_language', "", time() - 3600, '/' );
-	setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
-}
-
-function backend_localization_filter_var($lang){
-	return preg_replace('/\W/', '', $lang);
+	setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
 }
 
 add_action( 'init', 'init_backend_localization' );
 add_action( 'admin_menu', 'backend_localization_admin_menu' );
 add_action( 'admin_menu', 'backend_localization_save_setting' );
diff --git a/readme.txt b/readme.txt
index 2dd2b2d..b75555f 100644
--- a/readme.txt
+++ b/readme.txt
@@ -59,10 +59,11 @@ Every language that is supported by WordPress can be chosen. You just need a cop
 No you don't have to. I love qTranslate and use it for my own blog. qTranslate also offers the ability to switch the backend language. But if you don't want to publish the content of your blog in more than one language, you shouldn't use qTranslate. For I created this plugin for users who only wan't to switch the backend language without the overhead of any multilingual plugin. 
 
    
 == Change Log ==
 
+* **2.0.1** Fixing shown language in the switching message. Use htmlspecialchars() to prevent XSS vulnerabilities. Thanks again to Matt Fuller for teaching me how to do it correctly!
 * **2.0** Adding some new languages. Fixing link to switch languages in backend. Thanks to Justin! Fixing XSS vulnerabilities. Many Thanks to Matt Fuller from MOZILLA!
 * **1.6.1** Fixing typo in language names 
 * **1.6** Add WP3 CSS class for the language select on the login form
 * **1.5** Fixing the plugin for WordPress 3.0 MULTISITE feature
 * **1.4** Fixing the plugin for WordPress MU and fixing the login form selection

Vulnerable code: Version: 2.0
			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$locale_value], admin_url() )
	
	// set default if values haven't been recieved from the database
	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
		setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
			? backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] )
	setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
}

function backend_localization_filter_var($lang){
	return preg_replace('/\W/', '', $lang);
Fixed code: Version: 2.1
	// set default if values haven't been recieved from the database
	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
	
			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$backend_locale], admin_url() )
		setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
			? htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] )
	setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
* **2.0.1** Fixing shown language in the switching message. Use htmlspecialchars() to prevent XSS vulnerabilities. Thanks again to Matt Fuller for teaching me how to do it correctly!