CVE-2012-1208: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-02-24T13:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/core/engine/base.php
Commit date: 2012-02-13 20:23:02 +0100
Commit message: This should fix the backend XSS.

Diff: diff --git a/backend/core/engine/base.php b/backend/core/engine/base.php
index 60897359c..0d3b21671 100644
--- a/backend/core/engine/base.php
+++ b/backend/core/engine/base.php
@@ -9,10 +9,11 @@
 
 /**
  * This class implements a lot of functionality that can be extended by a specific action
  *
  * @author Tijs Verkoyen <tijs@sumocoders.be>
+ * @author Frederik Heyninck <frederik@figure8.be>
  */
 class BackendBaseAction
 {
 	/**
 	 * The current action
@@ -166,25 +167,25 @@ class BackendBaseAction
 		{
 			// show the report
 			$this->tpl->assign('report', true);
 
 			// camelcase the string
-			$messageName = SpoonFilter::toCamelCase($this->getParameter('report'), '-');
+			$messageName = SpoonFilter::toCamelCase(SpoonFilter::stripHTML($this->getParameter('report')), '-');
 
 			// if we have data to use it will be passed as the var parameter
 			if(!empty($var)) $this->tpl->assign('reportMessage', vsprintf(BL::msg($messageName), $var));
 			else $this->tpl->assign('reportMessage', BL::msg($messageName));
 
 			// highlight an element with the given id if needed
-			if($this->getParameter('highlight')) $this->tpl->assign('highlight', $this->getParameter('highlight'));
+			if($this->getParameter('highlight')) $this->tpl->assign('highlight', SpoonFilter::stripHTML($this->getParameter('highlight')));
 		}
 
 		// is there an error to show?
 		if($this->getParameter('error') !== null)
 		{
 			// camelcase the string
-			$errorName = SpoonFilter::toCamelCase($this->getParameter('error'), '-');
+			$errorName = SpoonFilter::toCamelCase(SpoonFilter::stripHTML($this->getParameter('error')), '-');
 
 			// if we have data to use it will be passed as the var parameter
 			if(!empty($var)) $this->tpl->assign('errorMessage', vsprintf(BL::err($errorName), $var));
 			else $this->tpl->assign('errorMessage', BL::err($errorName));
 		}

Vulnerable code: 			$messageName = SpoonFilter::toCamelCase($this->getParameter('report'), '-');
			if($this->getParameter('highlight')) $this->tpl->assign('highlight', $this->getParameter('highlight'));
			$errorName = SpoonFilter::toCamelCase($this->getParameter('error'), '-');
Fixed code:  * @author Frederik Heyninck <frederik@figure8.be>
			$messageName = SpoonFilter::toCamelCase(SpoonFilter::stripHTML($this->getParameter('report')), '-');
			if($this->getParameter('highlight')) $this->tpl->assign('highlight', SpoonFilter::stripHTML($this->getParameter('highlight')));
			$errorName = SpoonFilter::toCamelCase(SpoonFilter::stripHTML($this->getParameter('error')), '-');