CVE-2012-5164: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-26T00:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: frontend/modules/search/ajax/autocomplete.php, frontend/modules/search/ajax/autosuggest.php, frontend/modules/search/ajax/livesuggest.php, frontend/modules/search/ajax/save.php
Commit date: 2012-03-01 11:05:54 +0100
Commit message: XSS: Escape the input on ajax searches.

Diff: diff --git a/frontend/modules/search/ajax/autocomplete.php b/frontend/modules/search/ajax/autocomplete.php
index a8b781f1a..d5597005b 100644
--- a/frontend/modules/search/ajax/autocomplete.php
+++ b/frontend/modules/search/ajax/autocomplete.php
@@ -21,11 +21,12 @@ class FrontendSearchAjaxAutocomplete extends FrontendBaseAJAXAction
 	{
 		// call parent, this will probably add some general CSS/JS or other required files
 		parent::execute();
 
 		// get parameters
-		$term = SpoonFilter::getPostValue('term', null, '');
+		$searchTerm = SpoonFilter::getPostValue('term', null, '');
+		$term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
 		$limit = (int) FrontendModel::getModuleSetting('search', 'autocomplete_num_items', 10);
 
 		// validate
 		if($term == '') $this->output(self::BAD_REQUEST, null, 'term-parameter is missing.');
 
diff --git a/frontend/modules/search/ajax/autosuggest.php b/frontend/modules/search/ajax/autosuggest.php
index 395d229e8..b1cbf6a48 100644
--- a/frontend/modules/search/ajax/autosuggest.php
+++ b/frontend/modules/search/ajax/autosuggest.php
@@ -212,11 +212,12 @@ class FrontendSearchAjaxAutosuggest extends FrontendBaseAJAXAction
 	 * Validate the form
 	 */
 	private function validateForm()
 	{
 		// set values
-		$this->term = SpoonFilter::getPostValue('term', null, '');
+		$searchTerm = SpoonFilter::getPostValue('term', null, '');
+		$this->term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
 		$this->length = (int) SpoonFilter::getPostValue('length', null, 50);
 
 		// validate
 		if($this->term == '') $this->output(self::BAD_REQUEST, null, 'term-parameter is missing.');
 	}
diff --git a/frontend/modules/search/ajax/livesuggest.php b/frontend/modules/search/ajax/livesuggest.php
index 2bb6163cf..8dd60cfa3 100644
--- a/frontend/modules/search/ajax/livesuggest.php
+++ b/frontend/modules/search/ajax/livesuggest.php
@@ -363,11 +363,12 @@ class FrontendSearchAjaxLivesuggest extends FrontendBaseAJAXAction
 	 * Validate the form
 	 */
 	private function validateForm()
 	{
 		// set search term
-		$this->term = SpoonFilter::getPostValue('term', null, '');
+		$searchTerm = SpoonFilter::getPostValue('term', null, '');
+		$this->term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
 
 		// validate
 		if($this->term == '') $this->output(self::BAD_REQUEST, null, 'term-parameter is missing.');
 	}
 }
diff --git a/frontend/modules/search/ajax/save.php b/frontend/modules/search/ajax/save.php
index 4be54dca9..351030d7a 100644
--- a/frontend/modules/search/ajax/save.php
+++ b/frontend/modules/search/ajax/save.php
@@ -20,11 +20,12 @@ class FrontendSearchAjaxSave extends FrontendBaseAJAXAction
 	public function execute()
 	{
 		parent::execute();
 
 		// get parameters
-		$term = SpoonFilter::getPostValue('term', null, '');
+		$searchTerm = SpoonFilter::getPostValue('term', null, '');
+		$term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
 
 		// validate
 		if($term == '') $this->output(self::BAD_REQUEST, null, 'term-parameter is missing.');
 
 		// previous search result

Vulnerable code: 		$term = SpoonFilter::getPostValue('term', null, '');
		$this->term = SpoonFilter::getPostValue('term', null, '');
		$this->term = SpoonFilter::getPostValue('term', null, '');
		$term = SpoonFilter::getPostValue('term', null, '');
Fixed code: 		$searchTerm = SpoonFilter::getPostValue('term', null, '');
		$term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
		$searchTerm = SpoonFilter::getPostValue('term', null, '');
		$this->term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
		$searchTerm = SpoonFilter::getPostValue('term', null, '');
		$this->term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);
		$searchTerm = SpoonFilter::getPostValue('term', null, '');
		$term = (SPOON_CHARSET == 'utf-8') ? SpoonFilter::htmlspecialchars($searchTerm) : SpoonFilter::htmlentities($searchTerm);