CVE-2015-10110: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-02T00:15Z
Repository: https://github.com/wp-plugins/tinychat-roomspy
Language: Other
Files changed: readme.txt, room-spy.php
Commit date: 2015-04-18 16:49:52 +0000
Commit message: Added a character limit and removal of special characters to combat XSS attacks.

git-svn-id: https://plugins.svn.wordpress.org/tinychat-roomspy/trunk@1138083 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/readme.txt b/readme.txt
index 42f93c2..00f0130 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,11 +3,11 @@
 Contributors: ruddernation
 Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=FFAC7FBEBH6JE
 Tags: tinychat-roomspy, tinychat, chat, room spy, wordpress chat, buddypress chat, wordpress video chat, buddypress video chat
 Requires at least: 3.6.0
 Tested up to: 4.1.1
-Stable tag: 1.2.8
+Stable tag: 1.2.9
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
 == Description ==
 Allows you to check who is in a TinyChat room and who is on Video/Audio, This is very useful for checking who is in a room before you enter it,
diff --git a/room-spy.php b/room-spy.php
index 5520118..09482bc 100644
--- a/room-spy.php
+++ b/room-spy.php
@@ -5,18 +5,18 @@
 * Author: Ruddernation Designs
 * Author URI: http://profiles.wordpress.org/ruddernation
 * Description: Allows you to check who is in a TinyChat room and who is on Video/Audio.
 * Requires at least: WordPress 3.6.0, BuddyPress 1.8.1
 * Tested up to: WordPress 4.1.1 / BuddyPress 2.2.2.1
-* Version: 1.2.8
+* Version: 1.2.9
 * License: GPLv3
 * License URI: http://www.gnu.org/licenses/gpl-3.0.html
-* Date: 14th April 2015
+* Date: 18th April 2015
 */
 // Turn off all error reporting
 error_reporting(0);
-define('COMPARE_VERSION', '1.2.7');
+define('COMPARE_VERSION', '1.2.8');
 register_activation_hook(__FILE__, 'room_spy_install');
 function room_spy_install() {
 
 	global $wpdb, $wp_version;
 	$post_date = date("Y-m-d H:i:s");
@@ -60,10 +60,12 @@ function wp_show_room_spy() {
 	$room = $_POST ['room']; 
 	$names = $_POST ['username'];
 if (($room === 'Room')){}
 	elseif(preg_match("/^[a-z0-9]{3,}/", $_POST['room'])){
 	$room = preg_replace('/[^a-z0-9]/s', '',$room);
+	$room=(strlen($room) > 32) ? substr($room,0,32).'' : $room;
+	$room=htmlspecialchars($room,ENT_QUOTES, 'UTF-8');
 	$data = file_get_contents('http://api.tinychat.com/'.$room.'.xml');
 	$rooms = new SimpleXMLElement($data,libxml_use_internal_errors(true));
 	$array = json_decode(json_encode((array)simplexml_load_string($xml)),1);}?>
 <div><?php echo ' 
 <form method="post">Room Name: <input type="text" name="room" title="Just enter the name of the tinychat room and press spy." placeholder="Lowercase Letters!"/> <input type="submit" value="Spy" name="monachechat4"/>&nbsp;&bull;&nbsp;Admins: '.$rooms['mod_count'].'&nbsp;&bull;&nbsp;Chatters: '.$rooms['total_count'].'&nbsp;&bull;&nbsp;On Cam: '.$rooms['broadcaster_count'].'<a class="password" title="Password is required to enter the room"/>'.$rooms['error'].'</a>';if($room!=='Room name'){echo '</form>';}?> </div><br><?php

Vulnerable code: Stable tag: 1.2.8
* Version: 1.2.8
* Date: 14th April 2015
define('COMPARE_VERSION', '1.2.7');
Fixed code: Stable tag: 1.2.9
* Version: 1.2.9
* Date: 18th April 2015
define('COMPARE_VERSION', '1.2.8');
	$room=(strlen($room) > 32) ? substr($room,0,32).'' : $room;
	$room=htmlspecialchars($room,ENT_QUOTES, 'UTF-8');