CVE-2021-4431 (PHP, published 2023-11-07T11:15Z)
Description: value: A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22. Affected is an unknown function of the file FMDataAPI_Sample.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 23 is able to address this issue. The patch is identified as 3bd1709a8f7b1720529bf5dfc9855ad609f436cf. It is recommended to upgrade the affected component. VDB-244494 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/msyk/FMDataAPI
Files changed:
samples/FMDataAPI_Sample.php
Commit message: Fix XSS in FMDataAPI_Sample.php


Vulnerable code:
    echo "Product Info: {$pInfo}<hr>";
    echo "Database Names: {$pInfo}<hr>";
    echo "Layout Names: {$pInfo}<hr>";
    echo "Script Names: {$pInfo}<hr>";
    echo "Layout Metadata: {$pInfo}<hr>";
    echo "Layout Metadata (Old): {$pInfo}<hr>";
    echo "HTTP Status: {$fmdb->httpStatus()}<hr>";
    echo "Error Code: {$fmdb->errorCode()}<hr>";
    echo "Error Message: {$fmdb->errorMessage()}<hr>";
    echo "Target Table: {$fmdb->getTargetTable()}<hr>";
    echo "Total Count: {$fmdb->getTotalCount()}<hr>";
    echo "Found Count: {$fmdb->getFoundCount()}<hr>";
    echo "Returned Count: {$fmdb->getReturnedCount()}<hr>";
        echo "Target Table: {$result->getTargetTable()}<hr>";
        echo "Total Count: {$result->getTotalCount()}<hr>";
        echo "Found Count: {$result->getFoundCount()}<hr>";
        echo "Returned Count: {$result->getReturnedCount()}<hr>";
            echo "id: {$record->id},";
            echo "name: {$record->name},";
            echo "mail: {$record->mail}<hr>";
            $contacts = $record->contact_to;
            echo "Target Table: {$contacts->getTargetTable()}<hr>";
            echo "Total Count: {$contacts->getTotalCount()}<hr>";
            echo "Found Count: {$contacts->getFoundCount()}<hr>";
            echo "Returned Count: {$contacts->getReturnedCount()}<hr>";
                echo "[PORTAL(contact_to)] id: {$item->field("id", "contact_to")},";
                echo "summary: {$item->field("summary", "contact_to")}<hr>";
            echo "id: {$result->id},";
            echo "name: {$result->name},";
            echo "mail: {$result->mail}<hr>";
            $contacts = $result->contact_to;
                echo "[PORTAL(contact_to)] id: {$contacts->field("id", "contact_to")},";
                echo "summary: {$contacts->field("summary", "contact_to")}<hr>";
            echo "f3: {$record->f3},";
            echo "f7: {$record->f7},";
            echo "f8: {$record->f8}<hr>";
            echo "f3: {$record->f3},";
            echo "f7: {$record->f7},";
            echo "f8: {$record->f8}<hr>";
        echo "Script Error: {$fmdb->person_layout->getScriptError()}<hr>";
        echo "Script Result: {$fmdb->person_layout->getScriptResult()}<hr>";
        echo "Script Error: {$fmdb->person_layout->getScriptErrorPrerequest()}<hr>";
        echo "Script Result: {$fmdb->person_layout->getScriptResultPrerequest()}<hr>";
        echo "Script Error: {$fmdb->person_layout->getScriptError()}<hr>";
        echo "Script Result: {$fmdb->person_layout->getScriptResult()}<hr>";
        echo "Script Error: {$fmdb->person_layout->getScriptError()}<hr>";
        echo "Script Result: {$fmdb->person_layout->getScriptResult()}<hr>";
    echo "Target Table(getRecord): {$result->getTargetTable()}<hr>";
    echo "Total Count(getRecord): {$result->getTotalCount()}<hr>";
    echo "Found Count(getRecord): {$result->getFoundCount()}<hr>";
    echo "Returned Count(getRecord): {$result->getReturnedCount()}<hr>";
            echo "vc1: {$record->vc1}<hr>";
    echo '<div><h3>例外発生</h3>', $e->getMessage(), "<div>";

Fixed code:
    echo htmlspecialchars("Product Info: {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Database Names: {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Layout Names: {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Script Names: {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Layout Metadata: {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Layout Metadata (Old): {$pInfo}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("HTTP Status: {$fmdb->httpStatus()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Error Code: {$fmdb->errorCode()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Error Message: {$fmdb->errorMessage()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Target Table: {$fmdb->getTargetTable()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Total Count: {$fmdb->getTotalCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Found Count: {$fmdb->getFoundCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Returned Count: {$fmdb->getReturnedCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Target Table: {$result->getTargetTable()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Total Count: {$result->getTotalCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Found Count: {$result->getFoundCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Returned Count: {$result->getReturnedCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("id: {$record->id},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("name: {$record->name},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("mail: {$record->mail}", ENT_QUOTES, "UTF-8") . "<hr>";
            $contacts = $record->Contact;
            echo htmlspecialchars("Target Table: {$contacts->getTargetTable()}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("Total Count: {$contacts->getTotalCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("Found Count: {$contacts->getFoundCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("Returned Count: {$contacts->getReturnedCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
                echo htmlspecialchars("[PORTAL(contact_to)] id: {$item->field("id", "contact_to")},", ENT_QUOTES, "UTF-8");
                echo htmlspecialchars("summary: {$item->field("summary", "contact_to")}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("id: {$result->id},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("name: {$result->name},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("mail: {$result->mail}", ENT_QUOTES, "UTF-8") . "<hr>";
            $contacts = $result->Contact;
                echo htmlspecialchars("[PORTAL(contact_to)] id: {$contacts->field("id", "contact_to")},", ENT_QUOTES, "UTF-8");
                echo htmlspecialchars("summary: {$contacts->field("summary", "contact_to")}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("f3: {$record->f3},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("f7: {$record->f7},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("f8: {$record->f8}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("f3: {$record->f3},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("f7: {$record->f7},", ENT_QUOTES, "UTF-8");
            echo htmlspecialchars("f8: {$record->f8}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Error: {$fmdb->person_layout->getScriptError()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Result: {$fmdb->person_layout->getScriptResult()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Error: {$fmdb->person_layout->getScriptErrorPrerequest()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Result: {$fmdb->person_layout->getScriptResultPrerequest()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Error: {$fmdb->person_layout->getScriptError()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Result: {$fmdb->person_layout->getScriptResult()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Error: {$fmdb->person_layout->getScriptError()}", ENT_QUOTES, "UTF-8") . "<hr>";
        echo htmlspecialchars("Script Result: {$fmdb->person_layout->getScriptResult()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Target Table(getRecord): {$result->getTargetTable()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Total Count(getRecord): {$result->getTotalCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Found Count(getRecord): {$result->getFoundCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo htmlspecialchars("Returned Count(getRecord): {$result->getReturnedCount()}", ENT_QUOTES, "UTF-8") . "<hr>";
            echo htmlspecialchars("vc1: {$record->vc1}", ENT_QUOTES, "UTF-8") . "<hr>";
    echo '<div><h3>例外発生</h3>', htmlspecialchars($e->getMessage(), ENT_QUOTES, "UTF-8"), "<div>";