CVE-2021-35265: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-08-03T12:15Z
Repository: https://github.com/maxsite/cms
Language: PHP
Files changed: application/maxsite/common/core/format.php, application/maxsite/common/core/url.php, application/maxsite/plugins/global_cache/index.php, application/maxsite/plugins/sape/index.php
Commit date: 2020-10-21 12:51:57 +0300
Commit message: Fix #414

Diff: diff --git a/application/maxsite/common/core/format.php b/application/maxsite/common/core/format.php
index 3b9a6e5..9480360 100644
--- a/application/maxsite/common/core/format.php
+++ b/application/maxsite/common/core/format.php
@@ -78,11 +78,12 @@ function mso_menu_build($menu = '', $select_css = 'selected', $add_link_admin =
 	foreach ($menu as $elem) {
 		if (strlen(trim($elem)) > 1) $count_menu++;
 	}
 
 	// определим текущий url
-	$current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	$current_url = mso_current_url(true);
+	// $current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
 
 	$out = '';
 
 	$i = 1; // номер пункта
 	$n = 0; // номер итерации цикла 
diff --git a/application/maxsite/common/core/url.php b/application/maxsite/common/core/url.php
index 8a40ecf..4ccbe5a 100644
--- a/application/maxsite/common/core/url.php
+++ b/application/maxsite/common/core/url.php
@@ -42,11 +42,11 @@ function mso_segment_array()
 	$CI = &get_instance();
 
 	if (isset($_SERVER['REQUEST_URI']) and $_SERVER['REQUEST_URI']) {
 		// http://localhost/page/privet?get=hello
 		$url = getinfo('site_protocol');
-		$url .= $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+		$url .= $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
 		$url = str_replace($CI->config->config['base_url'], '', $url); // page/privet?get=hello
 
 		if (strpos($url, '?') !== FALSE) {
 			// есть «?»
 			$url = explode('?', $url); // разделим в массив
@@ -76,11 +76,11 @@ function mso_segment_array()
 // получение get-строки из текущего адреса
 function mso_url_get()
 {
 	$CI = &get_instance();
 	if (isset($_SERVER['REQUEST_URI']) and $_SERVER['REQUEST_URI'] and (strpos($_SERVER['REQUEST_URI'], '?') !== FALSE)) {
-		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
 		$url = str_replace($CI->config->config['base_url'], "", $url);
 		$url = explode('?', $url);
 
 		return $url[1];
 	} else {
@@ -219,11 +219,13 @@ function mso_get_permalink_page($id = 0, $prefix = 'page/')
 // получение текущего url относительно сайта
 // ведущий и конечные слэши удаляем
 // если $absolute = true, то возвращается текущий урл как есть
 function mso_current_url($absolute = false, $explode = false, $delete_request = false)
 {
-	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
+	
+	//pr($url);
 
 	if ($delete_request) {
 		// отделим по «?»
 		$url = explode('?', $url);
 		$url = $url[0];
diff --git a/application/maxsite/plugins/global_cache/index.php b/application/maxsite/plugins/global_cache/index.php
index 08fd115..3770188 100644
--- a/application/maxsite/plugins/global_cache/index.php
+++ b/application/maxsite/plugins/global_cache/index.php
@@ -63,11 +63,11 @@ function global_cache_uninstall($args = array())
 
 # текущий ключ
 # если $dir = true, то добавляем каталог html
 function global_cache_key($dir = true)
 {
-	$cache_key = $_SERVER['REQUEST_URI'];
+	$cache_key =  mso_clean_str($_SERVER['REQUEST_URI']); //$_SERVER['REQUEST_URI'];
 	$cache_key = str_replace('/', '-', $cache_key);
 	$cache_key = mso_slug(' ' . $cache_key);
 	
 	if (!$cache_key) $cache_key = 'home'; // главная
 	
diff --git a/application/maxsite/plugins/sape/index.php b/application/maxsite/plugins/sape/index.php
index b254b6a..9dde1a2 100644
--- a/application/maxsite/plugins/sape/index.php
+++ b/application/maxsite/plugins/sape/index.php
@@ -76,11 +76,11 @@ function sape_init($args = array())
 		// анализируем входящий url на предмет ?
 		// если есть, то делаем редирект на то, что до ?
 			// таким образом обнаружить продажную ссылку будет невозможно
 			if (isset($_SERVER['argv']) and $_SERVER['argv']) // есть какие-то параметры - делаем редирект
 			{
-				$url = $_SERVER['REQUEST_URI']; // /?nono  /about/?momo
+				$url =  mso_clean_str($_SERVER['REQUEST_URI']); // $_SERVER['REQUEST_URI']; // /?nono  /about/?momo
 				
 				$url = explode('?', $url);
 				if (isset($url[0])) $url = $url[0];
 				else $url = '';
 				

Vulnerable code: 	$current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url .= $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	$cache_key = $_SERVER['REQUEST_URI'];
				$url = $_SERVER['REQUEST_URI']; // /?nono  /about/?momo
Fixed code: 	$current_url = mso_current_url(true);
	// $current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url .= $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
	
	//pr($url);
	$cache_key =  mso_clean_str($_SERVER['REQUEST_URI']); //$_SERVER['REQUEST_URI'];
				$url =  mso_clean_str($_SERVER['REQUEST_URI']); // $_SERVER['REQUEST_URI']; // /?nono  /about/?momo