CVE-2023-1754 (PHP, published 2023-03-31T01:15Z)
Description: value: Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/group.php
Commit message: fix: added missing conversion to HTML entities, removed obsolete code


Vulnerable code:
              <?= $PMF_LANG['ad_group_deleteGroup'] ?> "<?= $groupData['name'] ?>"
    $groupName = Filter::filterInput(INPUT_POST, 'group_name', FILTER_UNSAFE_RAW, '');
    $groupDescription = Filter::filterInput(INPUT_POST, 'group_description', FILTER_UNSAFE_RAW, '');
    if ($groupName == '') {
// Import LDAP groups
/*
if ('import-ldap-groups' === $groupAction && $user->perm->hasPermission($user->getUserId(), 'addgroup')) {
    $user = new CurrentUser($faqConfig);
    $message = '';
    $messages = [];

    // Temporary data
    $groupName = 'LDAP Group';
    $groupDescription = 'This is a LDAP group import demo';
    $groupAutoJoin = false;

    $csrfOkay = true;
    $csrfToken = Filter::filterInput(INPUT_POST, 'csrf', FILTER_UNSAFE_RAW);

    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
        $csrfOkay = false;
    }

    // check group name
    if ($groupName == '') {
        $messages[] = $PMF_LANG['ad_group_error_noName'];
    }

    // ok, let's go
    if (count($messages) == 0 && $csrfOkay) {
        // create group
        $groupData = [
            'name' => $groupName,
            'description' => $groupDescription,
            'auto_join' => $groupAutoJoin,
        ];

        if ($user->perm->addGroup($groupData) <= 0) {
            $messages[] = $PMF_LANG['ad_adus_dberr'];
        }
    }

    // no errors, show list
    if (count($messages) == 0) {
        $groupAction = $defaultGroupAction;
        $message = sprintf('<p class="alert alert-success">%s</p>', $PMF_LANG['ad_group_suc']);
        // display error messages and show form again
    } else {
        $groupAction = 'import-ldap-groups';
        $message = '<p class="alert alert-danger">';
        foreach ($messages as $err) {
            $message .= $err . '<br>';
        }
        $message .= '</p>';
    }
}
*/

      <!--
      <div class="card mb-4">
        <div class="card-header py-3">
          <form id="group-import-ldap-groups" method="post"
                name="group-import-ldap-groups" action="?action=group&amp;group_action=import-ldap-groups">
            <input type="hidden" name="csrf" value="<?= $currentUser->getCsrfTokenFromSession() ?>">
            <button class="btn btn-success" type="submit">
              Import LDAP groups
            </button>
          </form>
        </div>
      </div>
      -->


Fixed code:
use phpMyFAQ\Strings;
              <?= $PMF_LANG['ad_group_deleteGroup'] ?> "<?= Strings::htmlentities($groupData['name']) ?>"
    $groupName = Filter::filterInput(INPUT_POST, 'group_name', FILTER_SANITIZE_SPECIAL_CHARS, '');
    $groupDescription = Filter::filterInput(INPUT_POST, 'group_description', FILTER_SANITIZE_SPECIAL_CHARS, '');
    if ($groupName === '') {