CVE-2023-44796 (PHP, published 2023-11-18T00:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/limesurvey/limesurvey
Files changed:
application/models/TemplateConfiguration.php
application/views/admin/globalsettings/_general.php
application/views/admin/survey/subview/accordion/_generaloptions_panel.php
Commit message: Fixed issue #19099: [security] XSS vulnerability caused by themeOptions/importManifest (#3483)

Co-authored-by: Denis Chenu <shnoulle@localhost.localdomain>

Vulnerable code:
        $templateName = CHtml::encode($this->template_name);
            'linkId'           => 'template_editor_link_' . $templateName,
            'linkId'           => 'template_options_link_' . $templateName ,
            'linkId'           => 'extendthis_' . $templateName,
            'linkId'           => 'remove_fromdb_link_' . $templateName,
            'linkId'           => 'remove_fromdb_link_' . $templateName,
                        <option value='<?php echo $templatename; ?>' <?php echo ($thisdefaulttheme == $templatename) ? "selected='selected'" : "" ?> >
                            <?php echo $templatename; ?>
                        <option value='<?php echo $templatename; ?>' <?php echo ($thisadmintheme == $templatename) ? "selected='selected'" : "" ?> >
                            <?php echo $templateconfig->metadata->name; ?>
                            <?= gT('Inherit') . ' [' . $themeConf->template_name . ']'; ?>
                            <option value='<?php echo $templateName; ?>'
                            ><?php echo $templateName; ?></option>

Fixed code:
            array('template_name', 'filter', 'filter' => function ($value) {
                return sanitize_filename($value, false, false, false);
            }),
        /* Use sanitized filename for previous bad upload */
        $templateName = sanitize_filename($this->template_name, false, false, false);
            'linkId'           => 'template_editor_link_' . $this->id,
            'linkId'           => 'template_options_link_' . $this->id ,
            'linkId'           => 'extendthis_' . $this->id,
            'linkId'           => 'remove_fromdb_link_' . $this->id,
            'linkId'           => 'remove_fromdb_link_' . $this->id,
                        <option value='<?php echo CHtml::encode($themeName); ?>' <?php echo ($thisdefaulttheme == $templatename) ? "selected='selected'" : "" ?> >
                            <?php echo CHtml::encode($templatename); ?>
                        <option value='<?php echo CHtml::encode($templatename); ?>' <?php echo ($thisadmintheme == $templatename) ? "selected='selected'" : "" ?> >
                            <?php echo CHtml::encode($templateconfig->metadata->name); ?>
                            <?= gT('Inherit') . ' [' . CHtml::encode($themeConf->template_name) . ']'; ?>
                            <option value='<?php echo CHtml::encode($templateName); ?>'
                            ><?php echo CHtml::encode($templateName); ?></option>