CVE-2017-9451 (PHP, published 2017-06-06T16:29Z)
Description: value: Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatCore/flatCore-CMS
Files changed:
acp/core/dashboard.system.php
acp/core/list.themes.php
acp/core/pages.edit_form.php
acp/core/pages.snippets.php
acp/core/system.stats.php
acp/core/user.groups.php
acp/core/user.list.php
Commit message: Prevent XSS Vulnerability

Issue: Bug Report: XSS Vulnerability in acp.php on FlatCore v1.4.6 #34


Vulnerable code:
echo '<h3>System</h3>';
echo '<h5>Config</h5>';
echo '<dl class="dl-horizontal">';
echo '<dt>Server:</dt><dd>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</dd>';
	echo '<dt>System E-Mails:</dt><dd>' . $prefs_mailer_adr . '</dd>';
	echo '<dt>System E-Mails:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
	echo '<dt>E-Mail Name:</dt><dd>' . $prefs_mailer_name . '</dd>';
	echo '<dt>E-Mail Name:</dt><dd><span class="text-danger">'.$lang['missing_value'].'</span></dd>';
echo '</dl>';

echo '<hr>';
echo '<h4>' . $lang['f_user_drm'] . '</h4>';
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_pages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_pages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_editownpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_editownpages]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_system]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_files]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-ok-circle'></span> $lang[drm_user_can_publish]</li>";
	$list_str .= "<li><span class='glyphicon glyphicon-remove-circle'></span> $lang[drm_user_can_publish]</li>";
echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=moduls&sub=t" method="POST" class="form-horizontal">';
echo"\n <form id='editpage' action='$_SERVER[PHP_SELF]?tn=pages&sub=edit&editpage=$editpage' class='form-horizontal' method='POST'>\n";
echo'</div>'; /* EOL tab_info */
echo'<div class="tab-pane fade" id="content">';
echo'<div class="tab-pane fade" id="extracontent">';
echo"</div>"; /* EOL tab_extracontent */
echo'<div class="tab-pane fade" id="meta">';
echo"<div class='form-group'>
		<label class='control-label control-label-normal col-sm-2'>$lang[page_thumbnail]</label>
		<div class='col-sm-10'>";
echo "<option value=''>$lang[page_thumbnail]</option>";
echo"</select>";
echo"</div>
	 </div>";

echo"</fieldset>";

foreach($arr_Images as $page_thumbnails) {
		$selected = "";
		if($page_thumbnail == "$page_thumbnails") {
			$selected = "selected";
		}
		echo "<option $selected data-img-src='/content/iamages/$page_thumbnails' value='$page_thumbnails'>$page_thumbnails</option>";
}
		
echo'</div>'; /* EOL tab_meta */
echo'<div class="tab-pane fade" id="head">';
echo "<textarea name='page_head_styles' class='form-control aceEditor_css' rows='12'>$page_head_styles</textarea>";
echo "<textarea name='page_head_enhanced' class='form-control aceEditor_html' rows='12'>$page_head_enhanced</textarea>";
echo'</div>'; /* EOL tab_head */
echo'<div class="tab-pane fade" id="custom">';
echo'</div>'; /* EOL tab custom fields */
echo"</div>"; // EOL fancytabs
echo "<form action='$_SERVER[PHP_SELF]?tn=pages&sub=snippets' method='POST'>";
echo"<form action='$_SERVER[PHP_SELF]?tn=system&sub=stats' method='POST' class='form-inline'>";
echo '<form action="'.$_SERVER['PHP_SELF'].'?tn=user&sub=groups" method="POST">';
echo '<form action="'.$_SERVER[PHP_SELF].'?tn=user&sub=groups" method="POST">';
echo "<form action='$_SERVER[PHP_SELF]?tn=user' class='form-inline' method='POST'>";

Fixed code:

echo '<hr class="shadow" style="margin-top:0;">';

echo '<div class="panel panel-default">';

echo '<div class="panel-heading">Config</div>';
echo '<table class="table table-condensed">';
echo '<tr><td>Server:</td><td>' . $_SERVER['SERVER_NAME'] . ' (PHP '.phpversion().')</td></tr>';
	echo '<tr><td>System E-Mails:</td><td>' . $prefs_mailer_adr . '</td></tr>';
	echo '<tr><td>System E-Mails:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
	echo '<tr><td>E-Mail Name:</td><td>' . $prefs_mailer_name . '</td></tr>';
	echo '<tr><td>E-Mail Name:</td><td><span class="text-danger">'.$lang['missing_value'].'</span></td></tr>';
echo '</table>';
echo '</div>';
echo '<div class="panel panel-default">';
echo '<div class="panel-heading">' . $lang['f_user_drm'] . '</div>';
echo '<div class="panel-body">';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_pages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_pages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_editownpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_editownpages'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_system'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_files'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-ok-circle text-success"></span> '. $lang['drm_user_can_publish'].'</li>';
	$list_str .= '<li><span class="glyphicon glyphicon-remove-circle text-danger"></span> '. $lang['drm_user_can_publish'].'</li>';
echo '</div>';
echo '</div>';
echo '<form action="acp.php?tn=moduls&sub=t" method="POST" class="form-horizontal">';
echo '<form id="editpage" action="acp.php?tn=pages&sub=edit&editpage='.$editpage.'" class="form-horizontal" method="POST">';
echo '</div>'; /* EOL tab_info */
echo '<div class="tab-pane fade" id="content">';
echo '<div class="tab-pane fade" id="extracontent">';
echo '</div>'; /* EOL tab_extracontent */
echo '<div class="tab-pane fade" id="meta">';
echo '<div class="form-group">';
echo '<label class="control-label control-label-normal col-sm-2">'.$lang['page_thumbnail'].'</label>';
echo '<div class="col-sm-10">';
echo '<option value="">'.$lang['page_thumbnail'].'</option>';
echo '</select>';
echo '</div>';
echo '</div>';
echo '</fieldset>';
echo '</div>'; /* EOL tab_meta */
echo '<div class="tab-pane fade" id="head">';
echo '<textarea name="page_head_styles" class="form-control aceEditor_css" rows="12">'.$page_head_styles.'</textarea>';
echo '<textarea name="page_head_enhanced" class="form-control aceEditor_html" rows="12">'.$page_head_enhanced.'</textarea>';
echo '</div>'; /* EOL tab_head */
echo '<div class="tab-pane fade" id="custom">';
echo '</div>'; /* EOL tab custom fields */
echo '</div>'; // EOL fancytabs
echo "<form action='acp.php?tn=pages&sub=snippets' method='POST'>";
echo"<form action='acp.php?tn=system&sub=stats' method='POST' class='form-inline'>";
echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
echo '<form action="acp.php?tn=user&sub=groups" method="POST">';
echo "<form action='acp.php?tn=user' class='form-inline' method='POST'>";