Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2014-9701: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.5
Published: 2017-08-09T18:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/string_api.php
Commit date: 2015-01-17 00:29:14 +0100
Commit message: Fix URL redirection issue in login_page.php

The fix for issue #17648 failed to correct all cases of redirection.

Alejo Popovici discovered that the regex checking for URLs pointing to
other domains considered an URL with a single '/' as local, allowing
redirection e.g. to http:/google.com on certain browsers.

Fixes #17997 (CVE-2015-1042)

Diff: diff --git a/core/string_api.php b/core/string_api.php
index 567a54cfad..064cf69288 100644
--- a/core/string_api.php
+++ b/core/string_api.php
@@ -266,11 +266,11 @@ function string_sanitize_url( $p_url, $p_return_absolute = false ) {
 		$t_type = 3;
 	}
 
 	# Check for URL's pointing to other domains
 	if( 0 == $t_type || empty( $t_matches['script'] ) ||
-		3 == $t_type && preg_match( '@(?:[^:]*)?://@', $t_url ) > 0 ) {
+		3 == $t_type && preg_match( '@(?:[^:]*)?:/*@', $t_url ) > 0 ) {
 
 		return ( $p_return_absolute ? $t_path . '/' : '' ) . 'index.php';
 	}
 
 	# Start extracting regex matches

Vulnerable code: 		3 == $t_type && preg_match( '@(?:[^:]*)?://@', $t_url ) > 0 ) {
Fixed code: 		3 == $t_type && preg_match( '@(?:[^:]*)?:/*@', $t_url ) > 0 ) {
CVE-2015-5059: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2017-08-01T14:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: config_defaults_inc.php
Commit date: 2015-06-24 19:09:20 +0200
Commit message: Change default threshold to view project doc to VIEWER

Previously it was ANYBODY, which would let any user download files from
any project including private ones, even when they are not part of the
team.

Fixes #19873

Diff: diff --git a/config_defaults_inc.php b/config_defaults_inc.php
index 5aa3871240..6bb4aaaeda 100644
--- a/config_defaults_inc.php
+++ b/config_defaults_inc.php
@@ -2693,13 +2693,17 @@ $g_add_bugnote_threshold = REPORTER;
  */
 $g_update_bugnote_threshold = DEVELOPER;
 
 /**
  * Threshold needed to view project documentation
+ * Note: setting this to ANYBODY will let any user download attachments
+ * from private projects, regardless of their being a member of it.
+ * @see $g_enable_project_documentation
+ * @see $g_upload_project_file_threshold
  * @global integer $g_view_proj_doc_threshold
  */
-$g_view_proj_doc_threshold = ANYBODY;
+$g_view_proj_doc_threshold = VIEWER;
 
 /**
  * Site manager
  * @global integer $g_manage_site_threshold
  */

Vulnerable code: $g_view_proj_doc_threshold = ANYBODY;
Fixed code:  * Note: setting this to ANYBODY will let any user download attachments
 * from private projects, regardless of their being a member of it.
 * @see $g_enable_project_documentation
 * @see $g_upload_project_file_threshold
$g_view_proj_doc_threshold = VIEWER;
CVE-2016-6837: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-10T15:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/filter_api.php
Commit date: 2016-08-17 12:51:38 +0200
Commit message: Fix XSS in view_all_bug_page.php

The value of the view_type parameter on the view_all_bug_page.php page
was not encoded before being displayed.

This vulnerability was discovered by Will Dollman of Netcraft Ltd.

Initial patch modified to use strict comparison per Will's suggestion.

Fixes #21611

Diff: diff --git a/core/filter_api.php b/core/filter_api.php
index b1e2d89612..72ac90f1c3 100644
--- a/core/filter_api.php
+++ b/core/filter_api.php
@@ -487,13 +487,19 @@ function filter_ensure_valid_filter( array $p_filter_arr ) {
 	$t_cookie_vers = (int)substr( $p_filter_arr['_version'], 1 );
 	if( substr( FILTER_VERSION, 1 ) > $t_cookie_vers ) {
 		# if the version is old, update it
 		$p_filter_arr['_version'] = FILTER_VERSION;
 	}
+
+	# Filter view type - ensure it's either 'simple' or 'advanced' (prevent XSS)
 	if( !isset( $p_filter_arr['_view_type'] ) ) {
 		$p_filter_arr['_view_type'] = gpc_get_string( 'view_type', 'simple' );
 	}
+	if( $p_filter_arr['_view_type'] !== 'advanced' ) {
+		$p_filter_arr['_view_type'] = 'simple';
+	}
+
 	if( !isset( $p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] ) ) {
 		$p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, config_get( 'default_limit_view' ) );
 	}
 	if( !isset( $p_filter_arr[FILTER_PROPERTY_HIGHLIGHT_CHANGED] ) ) {
 		$p_filter_arr[FILTER_PROPERTY_HIGHLIGHT_CHANGED] = config_get( 'default_show_changed' );

Fixed code: 
	# Filter view type - ensure it's either 'simple' or 'advanced' (prevent XSS)
	if( $p_filter_arr['_view_type'] !== 'advanced' ) {
		$p_filter_arr['_view_type'] = 'simple';
	}
CVE-2017-12062: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-08-01T15:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: manage_user_page.php
Commit date: 2017-08-01 13:00:30 +0200
Commit message: Fix XSS in manage_user_page.php (CVE-2017-12062)

trichimtrich (https://twitter.com/trichimtrich) reported this
vulnerability, allowing an attacker to inject arbitrary code through a
crafted 'filter' form variable.

Prevent the attack by sanitizing the variable before output.

Fixes #23166

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Diff: diff --git a/manage_user_page.php b/manage_user_page.php
index fb43546026..2d6917e3da 100644
--- a/manage_user_page.php
+++ b/manage_user_page.php
@@ -270,11 +270,11 @@ $t_user_count = count( $t_users );
 		<fieldset>
 			<?php # CSRF protection not required here - form does not result in modifications ?>
 			<input type="hidden" name="sort" value="<?php echo $c_sort ?>" />
 			<input type="hidden" name="dir" value="<?php echo $c_dir ?>" />
 			<input type="hidden" name="save" value="1" />
-			<input type="hidden" name="filter" value="<?php echo $f_filter ?>" />
+			<input type="hidden" name="filter" value="<?php echo string_attribute( $f_filter ); ?>" />
 			<label class="inline">
 			<input type="checkbox" class="ace" name="hideinactive" value="<?php echo ON ?>" <?php check_checked( (int)$c_hide_inactive, ON ); ?> />
 			<span class="lbl"> <?php echo lang_get( 'hide_inactive' ) ?></span>
 			</label>
 			<label class="inline">

Vulnerable code: 			<input type="hidden" name="filter" value="<?php echo $f_filter ?>" />
Fixed code: 			<input type="hidden" name="filter" value="<?php echo string_attribute( $f_filter ); ?>" />
CVE-2017-6797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-10T00:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_change_status_page.php
Commit date: 2017-03-10 00:22:24 +0100
Commit message: Fix XSS in bug_change_status_page.php

The value of the change_type parameter was not encoded before being
displayed as a hidden input.

This vulnerability was reported by Etienne Landais.

Fixes #22486

Diff: diff --git a/bug_change_status_page.php b/bug_change_status_page.php
index 4e1c6fc2cf..bc23ce6173 100644
--- a/bug_change_status_page.php
+++ b/bug_change_status_page.php
@@ -383,11 +383,11 @@ layout_page_begin();
 	event_signal( 'EVENT_BUGNOTE_ADD_FORM', array( $f_bug_id ) );
 ?>
 
 </tbody>
 </table>
-<input type="hidden" name="action_type" value="<?php echo $f_change_type; ?>" />
+<input type="hidden" name="action_type" value="<?php echo string_attribute( $f_change_type ); ?>" />
 
 </div>
 </div>
 <div class="widget-toolbox padding-8 clearfix">
 	<input type="submit" class="btn btn-primary btn-white btn-round" value="<?php echo lang_get( $t_status_label . '_bug_button' ) ?>" />

Vulnerable code: <input type="hidden" name="action_type" value="<?php echo $f_change_type; ?>" />
Fixed code: <input type="hidden" name="action_type" value="<?php echo string_attribute( $f_change_type ); ?>" />
CVE-2017-6797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-10T00:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_change_status_page.php
Commit date: 2017-03-10 00:05:05 +0100
Commit message: Fix XSS in bug_change_status_page.php

The value of the change_type parameter was not encoded before being
displayed as a hidden input.

This vulnerability was reported by Etienne Landais.

Fixes #22486

Diff: diff --git a/bug_change_status_page.php b/bug_change_status_page.php
index 7e465cf846..12cf01a279 100644
--- a/bug_change_status_page.php
+++ b/bug_change_status_page.php
@@ -152,11 +152,11 @@ print_recently_visited();
 	<?php echo form_security_field( 'bug_update' ) ?>
 
 	<input type="hidden" name="bug_id" value="<?php echo $f_bug_id ?>" />
 	<input type="hidden" name="status" value="<?php echo $f_new_status ?>" />
 	<input type="hidden" name="last_updated" value="<?php echo $t_bug->last_updated ?>" />
-	<input type="hidden" name="action_type" value="<?php echo $f_change_type; ?>" />
+	<input type="hidden" name="action_type" value="<?php echo string_attribute( $f_change_type ); ?>" />
 
 <?php
 	$t_current_resolution = $t_bug->resolution;
 	$t_bug_is_open = $t_current_resolution < $t_resolved;
 

Vulnerable code: 	<input type="hidden" name="action_type" value="<?php echo $f_change_type; ?>" />
Fixed code: 	<input type="hidden" name="action_type" value="<?php echo string_attribute( $f_change_type ); ?>" />
CVE-2017-6799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-10T10:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: view_filters_page.php
Commit date: 2017-03-10 09:08:28 +0100
Commit message: Fix XSS in view_filters_page.php

The value of the view_type parameter was not sanitized before being
displayed as a hidden input.

This vulnerability was reported by Etienne Landais.

Fixes #22497

Diff: diff --git a/view_filters_page.php b/view_filters_page.php
index bccf4b09e6..5d807683d3 100644
--- a/view_filters_page.php
+++ b/view_filters_page.php
@@ -103,11 +103,11 @@ $t_filter = filter_ensure_valid_filter( $t_filter );
 
 	<form method="post" name="filters" id="filters_form_open" class="form-control" action="<?php echo $t_action; ?>">
 
 	<?php # CSRF protection not required here - form does not result in modifications ?>
 	<input type="hidden" name="type" value="1" />
-	<input type="hidden" name="view_type" value="<?php echo $f_view_type; ?>" />
+	<input type="hidden" name="view_type" value="<?php echo $t_filter['_view_type']; ?>" />
 	<?php
 		if( $f_for_screen == false ) {
 			print '<input type="hidden" name="print" value="1" />';
 			print '<input type="hidden" name="offset" value="0" />';
 		}

Vulnerable code: 	<input type="hidden" name="view_type" value="<?php echo $f_view_type; ?>" />
Fixed code: 	<input type="hidden" name="view_type" value="<?php echo $t_filter['_view_type']; ?>" />
CVE-2017-7222: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-22T05:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/layout_api.php
Commit date: 2017-02-16 20:27:52 -0800
Commit message: Sanitize window title

The window title is not sanitized.  That is not an issue when CSP is enable (default),
but if disabled, it can execute javascript that is set by a user who has access
to set configuration via Manage - Manage Configuration - Configuration Report page.

Fixes #22266

Diff: diff --git a/core/layout_api.php b/core/layout_api.php
index 6c648567a1..2648d8dc0a 100644
--- a/core/layout_api.php
+++ b/core/layout_api.php
@@ -413,11 +413,11 @@ function layout_navbar() {
 	echo '</button>';
 
 	echo '<div class="navbar-header">';
 	echo '<a href="' . $t_logo_url . '" class="navbar-brand">';
 	echo '<span class="smaller-75"> ';
-	echo config_get('window_title');
+	echo string_display_line( config_get('window_title') );
 	echo ' </span>';
 	echo '</a>';
 
 	$t_toggle_class = (OFF == config_get('show_avatar') ? 'navbar-toggle' : 'navbar-toggle-img');
 	echo '<button type="button" class="navbar-toggle ' . $t_toggle_class . ' collapsed pull-right hidden-sm hidden-md hidden-lg" data-toggle="collapse" data-target=".navbar-buttons,.navbar-menu">';

Vulnerable code: 	echo config_get('window_title');
Fixed code: 	echo string_display_line( config_get('window_title') );
CVE-2017-7897: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-04-18T17:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/timeline_inc.php
Commit date: 2017-04-18 18:12:58 +0200
Commit message: Fix XSS in timeline_inc.php

Use of $_SERVER['PHP_SELF'] and outputting it as-is allows an attacker
to inject arbitrary JavaScript as part of the URL.

Using SCRIPT_NAME and passing it through string_sanitize_url() instead
prevents the attack.

Fixes #22742
Fixes https://github.com/mantisbt/mantisbt/pull/1094

Diff: diff --git a/core/timeline_inc.php b/core/timeline_inc.php
index 40fe83037c..952711677d 100644
--- a/core/timeline_inc.php
+++ b/core/timeline_inc.php
@@ -44,11 +44,11 @@ $t_events = timeline_events( $t_start_time, $t_end_time, $t_max_events, $g_timel
 
 $t_collapse_block = is_collapsed( 'timeline' );
 $t_block_css = $t_collapse_block ? 'collapsed' : '';
 $t_block_icon = $t_collapse_block ? 'fa-chevron-down' : 'fa-chevron-up';
 
-$t_url_page = $_SERVER["PHP_SELF"];
+$t_url_page = string_sanitize_url( basename( $_SERVER['SCRIPT_NAME'] ) );
 $t_url_params = $_GET;
 if( isset( $t_url_params['all'] ) ) {
 	unset( $t_url_params['all'] );
 }
 ?>

Vulnerable code: $t_url_page = $_SERVER["PHP_SELF"];
Fixed code: $t_url_page = string_sanitize_url( basename( $_SERVER['SCRIPT_NAME'] ) );
CVE-2018-13055: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-08-03T18:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/filter_form_api.php
Commit date: 2018-07-23 21:37:54 +0200
Commit message: Fix XSS in filter_form_draw_inputs() (CVE-2018-13055)

Ömer Çıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php.

Prevent the attack by sanitizing the output of $_SERVER['PHP_SELF']
before display.

Fixes #24580

Diff: diff --git a/core/filter_form_api.php b/core/filter_form_api.php
index 8baa008a58..05d5c39e1e 100644
--- a/core/filter_form_api.php
+++ b/core/filter_form_api.php
@@ -2392,10 +2392,11 @@ function filter_form_draw_inputs( $p_filter, $p_for_screen = true, $p_static = f
 		$t_project_id = helper_get_current_project();
 	}
 
 	if( null === $p_static_fallback_page ) {
 		$p_static_fallback_page = $_SERVER['PHP_SELF'];
+		$p_static_fallback_page = string_sanitize_url( $_SERVER['PHP_SELF'] );
 	}
 	$t_filters_url = $p_static_fallback_page;
 	$t_get_params = $_GET;
 	$t_get_params['for_screen'] = $p_for_screen;
 	$t_get_params['static'] = ON;

Fixed code: 		$p_static_fallback_page = string_sanitize_url( $_SERVER['PHP_SELF'] );
CVE-2018-14504: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-08-03T18:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: manage_filter_edit_page.php
Commit date: 2018-07-23 22:49:28 +0200
Commit message: Fix XSS on filter edit page (CVE-2018-14504)

Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name.

Prevent the attack by sanitizing the filter name before display.

Fixes #24608

Diff: diff --git a/manage_filter_edit_page.php b/manage_filter_edit_page.php
index 074ca14bd0..9478d059c5 100644
--- a/manage_filter_edit_page.php
+++ b/manage_filter_edit_page.php
@@ -122,11 +122,11 @@ $t_filter_project_id = filter_get_field( $f_filter_id, 'project_id' );
 				<div class="widget-toolbox padding-8 clearfix">
 					<div class="btn-toolbar pull-left">
 						<div class="form-inline">
 							<label>
 								<?php echo lang_get( 'query_name' ) ?>&nbsp;
-								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo filter_get_field( $f_filter_id, 'name' ) ?>">
+								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo string_display_line( filter_get_field( $f_filter_id, 'name' ) ) ?>">
 							</label>
 						</div>
 					</div>
 				</div>
 

Vulnerable code: 								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo filter_get_field( $f_filter_id, 'name' ) ?>">
Fixed code: 								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo string_display_line( filter_get_field( $f_filter_id, 'name' ) ) ?>">
CVE-2018-6526: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2018-02-02T09:29Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/current_user_api.php
Commit date: 2018-02-02 12:14:42 +0100
Commit message: Fix PHP error - wrong argument type

Initialize $t_filter variable as array() instead of '' in
current_user_get_bug_filter(), to ensure its type is correct when
calling filter_ensure_valid_filter().

Fixes #23921

Diff: diff --git a/core/current_user_api.php b/core/current_user_api.php
index 85f854b833..e60e00504d 100644
--- a/core/current_user_api.php
+++ b/core/current_user_api.php
@@ -236,11 +236,11 @@ function current_user_ensure_unprotected() {
  * @return array User filter, if not set, then default filter.
  * @access public
  */
 function current_user_get_bug_filter( $p_project_id = null ) {
 	$f_filter_string = gpc_get_string( 'filter', '' );
-	$t_filter = '';
+	$t_filter = array();
 
 	if( !is_blank( $f_filter_string ) ) {
 		if( is_numeric( $f_filter_string ) ) {
 			$t_token = token_get_value( TOKEN_FILTER );
 			if( null != $t_token ) {

Vulnerable code: 	$t_filter = '';
Fixed code: 	$t_filter = array();
CVE-2019-15074: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2019-08-21T19:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/classes/IssueAttachmentTimelineEvent.class.php
Commit date: 2019-08-15 16:34:41 +0200
Commit message: Fix XSS on timeline (CVE-2019-15074)

Kamran Saifullah reported a stored cross-site scripting (XSS)
vulnerability in Timeline, allowing execution of arbitrary code (if CSP
settings permit it) after uploading an attachment with a crafted
filename. The code is executed for any user having visibility to the
issue, whenever My View Page is displayed.

Prevent the attack by sanitizing the filename before display.

Fixes #25995

Diff: diff --git a/core/classes/IssueAttachmentTimelineEvent.class.php b/core/classes/IssueAttachmentTimelineEvent.class.php
index 8e0425df49..2a6123d87c 100644
--- a/core/classes/IssueAttachmentTimelineEvent.class.php
+++ b/core/classes/IssueAttachmentTimelineEvent.class.php
@@ -71,11 +71,11 @@ class IssueAttachmentTimelineEvent extends TimelineEvent {
 		$t_html = $this->html_start( 'fa-file-o' );
 		$t_html .= '<div class="action">'
 			. sprintf( lang_get( $t_string ),
 				prepare_user_name( $this->user_id ),
 				$t_bug_link,
-				$this->filename
+				string_html_specialchars( $this->filename )
 			)
 			. '</div>';
 		$t_html .= $this->html_end();
 
 		return $t_html;

Vulnerable code: 				$this->filename
Fixed code: 				string_html_specialchars( $this->filename )
CVE-2019-15539: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-03-19T19:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: proj_doc_edit_page.php
Commit date: 2019-08-25 13:04:55 +0200
Commit message: Fix XSS on project documentation

Vulnerability in deprecated project documentation functionality
($g_enable_project_documentation), allowing execution of arbitrary
code (if CSP settings permit it) after uploading an attachment with a
crafted filename.

Prevent the attack by sanitizing the filename before display.

Fixes #26078

Diff: diff --git a/proj_doc_edit_page.php b/proj_doc_edit_page.php
index 10287277c7..759bc1bd01 100644
--- a/proj_doc_edit_page.php
+++ b/proj_doc_edit_page.php
@@ -120,11 +120,11 @@ print_doc_menu();
 	<td>
 		<?php
 			$t_href = '<a href="file_download.php?file_id='.$v_id.'&amp;type=doc">';
 			echo $t_href;
 			print_file_icon( $v_filename );
-			echo '</a>&#160;' . $t_href . file_get_display_name( $v_filename ) . '</a>';
+			echo '</a>&#160;' . $t_href . string_html_specialchars( file_get_display_name( $v_filename ) ) . '</a>';
 		?>
 	</td>
 </tr>
 <tr>
 	<td class="category">

Vulnerable code: 			echo '</a>&#160;' . $t_href . file_get_display_name( $v_filename ) . '</a>';
Fixed code: 			echo '</a>&#160;' . $t_href . string_html_specialchars( file_get_display_name( $v_filename ) ) . '</a>';
CVE-2019-15715: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.2
Published: 2019-10-09T20:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: config_defaults_inc.php
Commit date: 2019-09-21 17:28:34 +0200
Commit message: Prevent arbitrary shell command execution

Prior to this, Administrators were able to edit 'dot_tool' and
'neato_tool' config options from the Manage Configuration Page

These can now only be set in the config_inc.php file.

Fixes #26091, CVE-2019-15715

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Original commit message reworded, added CVE reference.

Diff: diff --git a/config_defaults_inc.php b/config_defaults_inc.php
index 6dc188dd6a1..516cd520eb7 100644
--- a/config_defaults_inc.php
+++ b/config_defaults_inc.php
@@ -4359,11 +4359,11 @@ $g_global_settings = array(
 	'file_type_icons', 'path', 'short_path', 'absolute_path', 'core_path',
 	'class_path','library_path', 'language_path', 'absolute_path_default_upload_folder',
 	'ldap_simulation_file_path', 'plugin_path', 'bottom_include_page', 'top_include_page',
 	'default_home_page', 'logout_redirect_page', 'manual_url', 'logo_url', 'wiki_engine_url',
 	'cdn_enabled', 'public_config_names', 'email_login_enabled', 'email_ensure_unique',
-	'impersonate_user_threshold', 'email_retry_in_days'
+	'impersonate_user_threshold', 'email_retry_in_days', 'neato_tool', 'dot_tool'
 );
 
 /**
  * List of config options available via SOAP API.
  * The following list of configuration options is used to check if it is

Vulnerable code: 	'impersonate_user_threshold', 'email_retry_in_days'
Fixed code: 	'impersonate_user_threshold', 'email_retry_in_days', 'neato_tool', 'dot_tool'
CVE-2019-15715: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.2
Published: 2019-10-09T20:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/graphviz_api.php
Commit date: 2019-09-21 18:02:59 +0200
Commit message: Escape GraphViz command before calling proc_open()

Fixes #26091, CVE-2019-15715

Diff: diff --git a/core/graphviz_api.php b/core/graphviz_api.php
index 44b6aa52d25..96721fe2edb 100644
--- a/core/graphviz_api.php
+++ b/core/graphviz_api.php
@@ -350,11 +350,11 @@ class Graph {
 		$t_dot_source = ob_get_contents();
 		ob_end_clean();
 
 		# Start dot process
 
-		$t_command = $this->graphviz_tool . ' -T' . $p_format;
+		$t_command = escapeshellcmd( $this->graphviz_tool . ' -T' . $p_format );
 		$t_descriptors = array(
 			0 => array( 'pipe', 'r', ),
 			1 => array( 'pipe', 'w', ),
 			2 => array( 'file', 'php://stderr', 'w', ),
 			);

Vulnerable code: 		$t_command = $this->graphviz_tool . ' -T' . $p_format;
Fixed code: 		$t_command = escapeshellcmd( $this->graphviz_tool . ' -T' . $p_format );
CVE-2020-25288: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-09-30T21:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/cfdefs/cfdef_standard.php
Commit date: 2020-09-23 19:04:55 +0200
Commit message: Fix XSS in Custom Field regex pattern validation

Improper escaping of the custom field definition's Regular Expression
allowed an attacker to inject HTML into the page (CVE-2020-25288).

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27275

Diff: diff --git a/core/cfdefs/cfdef_standard.php b/core/cfdefs/cfdef_standard.php
index 5653cdf78f1..039c1c86cac 100644
--- a/core/cfdefs/cfdef_standard.php
+++ b/core/cfdefs/cfdef_standard.php
@@ -465,11 +465,11 @@ function cfdef_input_textbox( array $p_field_def, $p_custom_field_value, $p_requ
 			$t_cf_regex = '.*' . $t_cf_regex;
 		}
 		if( substr( $t_cf_regex, -1 ) != '$' ) {
 			$t_cf_regex .= '.*';
 		}
-		echo ' pattern="' . $t_cf_regex . '"';
+		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"';
 	}
 	echo ' value="' . string_attribute( $p_custom_field_value ) .'" />';
 }
 
 /**

Vulnerable code: 		echo ' pattern="' . $t_cf_regex . '"';
Fixed code: 		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"';
CVE-2020-25830: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-09-30T21:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_actiongroup_page.php
Commit date: 2020-09-23 19:06:04 +0200
Commit message: Fix XSS in bug_actiongroup_page.php

Improper escaping of the custom field's name allowed an attacker to
inject HTML into the page.

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27304

Diff: diff --git a/bug_actiongroup_page.php b/bug_actiongroup_page.php
index cdebbf49e81..2610ab9cb20 100644
--- a/bug_actiongroup_page.php
+++ b/bug_actiongroup_page.php
@@ -223,11 +223,13 @@ switch( $f_action ) {
 		$t_button_title			= lang_get( 'due_date_group_bugs_button' );
 		$t_form					= 'due_date';
 		break;
 	case 'CUSTOM' :
 		$t_custom_field_def = custom_field_get_definition( $t_custom_field_id );
-		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), lang_get_defaulted( $t_custom_field_def['name'] ) );
+		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ),
+			string_attribute( lang_get_defaulted( $t_custom_field_def['name'] ) )
+		);
 		$t_button_title = $t_question_title;
 		$t_form = 'custom_field_' . $t_custom_field_id;
 		$t_event_params['custom_field_id'] = $t_custom_field_id;
 		break;
 	default:

Vulnerable code: 		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), lang_get_defaulted( $t_custom_field_def['name'] ) );
Fixed code: 		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ),
			string_attribute( lang_get_defaulted( $t_custom_field_def['name'] ) )
		);
CVE-2021-43257: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 7.8
Published: 2022-04-14T20:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/csv_api.php
Commit date: 2022-04-13 17:11:06 +0200
Commit message: Escape strings to prevent CSV injection

Prefixing the string with a tab when it starts with =, -, + or @.

Thanks to Devendra Bhatla for reporting the issue.

Fixes #29130, CVE-2021-43257

Diff: diff --git a/core/csv_api.php b/core/csv_api.php
index 21a690d5f6b..40c99078322 100644
--- a/core/csv_api.php
+++ b/core/csv_api.php
@@ -114,10 +114,17 @@ function csv_get_default_filename() {
  * @param string $p_string String to escape.
  * @return string
  * @access public
  */
 function csv_escape_string( $p_string ) {
+	# Prevent CSV injection by escaping text that could be interpreted as a formula
+	if( $p_string && strpos( '=-+@', $p_string[0] ) !== false ) {
+		# Prefixing with a tab rather than single quote, as Excel does not show
+		# the tab visually in the cell.
+		$p_string = "\t" . $p_string;
+	}
+
 	$t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
 	$t_must_escape = false;
 	while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
 		$t_must_escape = strpos( $p_string, $t_char ) !== false;
 		next( $t_escaped );

Fixed code: 	# Prevent CSV injection by escaping text that could be interpreted as a formula
	if( $p_string && strpos( '=-+@', $p_string[0] ) !== false ) {
		# Prefixing with a tab rather than single quote, as Excel does not show
		# the tab visually in the cell.
		$p_string = "\t" . $p_string;
	}
CVE-2023-44394: Exposure of Resource to Wrong Sphere (CWE-668)
value: MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.258`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 4.3
Published: 2023-10-16T22:15Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: wiki.php
Commit date: 2023-10-14 18:09:22 +0200
Commit message: Merge pull request from GHSA-v642-mh27-8j6m

Due to insufficient access-level checks on the Wiki redirection page,
any user could reveal private Projects' names, by accessing wiki.php
with sequentially incremented IDs.

Fixes #32981, CVE-2023-44394
Diff: diff --git a/wiki.php b/wiki.php
index 7d77f8a7608..428bf97fcef 100644
--- a/wiki.php
+++ b/wiki.php
@@ -41,14 +41,16 @@ $f_id = gpc_get_int( 'id' );
 $f_type = gpc_get_string( 'type', 'issue' );
 
 if( $f_type == 'project' ) {
 	if( $f_id !== 0 ) {
 		project_ensure_exists( $f_id );
+		access_ensure_project_level( VIEWER, $f_id );
 	}
 
 	$t_url = wiki_link_project( $f_id );
 } else {
 	bug_ensure_exists( $f_id );
+	access_ensure_bug_level( VIEWER, $f_id );
 	$t_url = wiki_link_bug( $f_id );
 }
 
 print_header_redirect( $t_url, true, false, true );

Fixed code: 		access_ensure_project_level( VIEWER, $f_id );
	access_ensure_bug_level( VIEWER, $f_id );
CVE-2019-16941: XML Injection (aka Blind XPath Injection) (CWE-91)
value: NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
CWE description: The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CVSS v3 base score: 9.8
Published: 2019-09-28T16:15Z
Repository: https://github.com/NationalSecurityAgency/ghidra
Language: Unknown
Commit date: 2019-10-02 09:27:36 -0400
Commit message: Merge remote-tracking branch 'origin/GT-3198_dev747368_fix_XMLDecoder_github_1090' into Ghidra_9.1
CVE-2018-19497: Out-of-bounds Read (CWE-125)
value: In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-11-29T23:29Z
Repository: https://github.com/sleuthkit/sleuthkit
Language: Unknown
Commit date: 2018-11-29 08:46:39 -0500
Commit message: Merge pull request #1374 from JordyZomer/develop

Fix CVE-2018-19497.
CVE-2020-10232: Out-of-bounds Write (CWE-787)
value: In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-03-09T00:15Z
Repository: https://github.com/sleuthkit/sleuthkit
Language: C++
Files changed: tsk/fs/yaffs.cpp
Commit date: 2020-02-22 12:17:25 -0800
Commit message: Fix stack buffer overflow in yaffsfs_istat

Prevent a stack buffer overflow in yaffsfs_istat by increasing the buffer size to the size required by tsk_fs_time_to_str.

Diff: diff --git a/tsk/fs/yaffs.cpp b/tsk/fs/yaffs.cpp
index 68d8b0219..f5ec30a09 100755
--- a/tsk/fs/yaffs.cpp
+++ b/tsk/fs/yaffs.cpp
@@ -2437,11 +2437,11 @@ static uint8_t
     TSK_FS_META *fs_meta;
     TSK_FS_FILE *fs_file;
     YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs;
     char ls[12];
     YAFFSFS_PRINT_ADDR print;
-    char timeBuf[32];
+    char timeBuf[128];
     YaffsCacheObject * obj = NULL;
     YaffsCacheVersion * version = NULL;
     YaffsHeader * header = NULL;
 
     yaffscache_version_find_by_inode(yfs, inum, &version, &obj);

Vulnerable code:     char timeBuf[32];
Fixed code:     char timeBuf[128];
CVE-2012-0973: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php.  NOTE: some of these details are obtained from third party information.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2012-09-25T23:55Z
Repository: https://github.com/osclass/OSClass
Language: Unknown
Commit date: 2012-01-16 19:44:06 +0100
Commit message: OSClass 2.3.5
CVE-2012-0974: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-25T23:55Z
Repository: https://github.com/osclass/OSClass
Language: Unknown
Commit date: 2012-01-16 19:44:06 +0100
Commit message: OSClass 2.3.5
CVE-2012-1617: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2012-09-26T00:55Z
Repository: https://github.com/osclass/OSClass
Language: PHP
Files changed: oc-content/themes/modern/combine.php, oc-includes/osclass/gui/combine.php
Commit date: 2012-02-01 12:11:16 +0100
Commit message: minor check in combine.php

Diff: diff --git a/oc-content/themes/modern/combine.php b/oc-content/themes/modern/combine.php
index c7716282..7798bb86 100644
--- a/oc-content/themes/modern/combine.php
+++ b/oc-content/themes/modern/combine.php
@@ -29,10 +29,15 @@
     $base     = dirname(__FILE__);
 
     $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
 
+    if( !in_array($type, array('css', 'js')) ) {
+        header ("HTTP/1.0 403 Forbidden") ;
+        exit ;
+    }
+
     // Determine last modification date of the files
     $lastmodified = 0;
     while( list(,$element) = each($elements) ) {
         $path = realpath($base . '/' . $element) ;
 
diff --git a/oc-includes/osclass/gui/combine.php b/oc-includes/osclass/gui/combine.php
index c7716282..7798bb86 100644
--- a/oc-includes/osclass/gui/combine.php
+++ b/oc-includes/osclass/gui/combine.php
@@ -29,10 +29,15 @@
     $base     = dirname(__FILE__);
 
     $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
 
+    if( !in_array($type, array('css', 'js')) ) {
+        header ("HTTP/1.0 403 Forbidden") ;
+        exit ;
+    }
+
     // Determine last modification date of the files
     $lastmodified = 0;
     while( list(,$element) = each($elements) ) {
         $path = realpath($base . '/' . $element) ;
 

Fixed code:     if( !in_array($type, array('css', 'js')) ) {
        header ("HTTP/1.0 403 Forbidden") ;
        exit ;
    }

    if( !in_array($type, array('css', 'js')) ) {
        header ("HTTP/1.0 403 Forbidden") ;
        exit ;
    }
CVE-2012-1617: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2012-09-26T00:55Z
Repository: https://github.com/osclass/OSClass
Language: Unknown
Commit date: 2012-01-16 19:44:06 +0100
Commit message: OSClass 2.3.5