CVE-2021-28280 (PHP, published 2021-04-29T15:15Z)
Description: value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/classes/PHPFusion/Search/Search_Engine.php
includes/dynamics/includes/form_main.php
Commit message: Fixes broken rendering trying to parse against <script> input values.


Vulnerable code:
    protected static $search_instance = NULL;

    public static $locale = [];

    /**
     * Returns params
     *
     * @param null $key
     *
     * @return array|string
     */
    public static function get_param($key = NULL) {
        $info = [
            'stype'        => self::$search_type,
            'stext'        => self::$search_text,
            'method'       => self::$search_method,
            'datelimit'    => self::$search_date_limit,
            'fields'       => self::$search_fields,
            'sort'         => self::$search_sort,
            'chars'        => self::$search_chars,
            'order'        => self::$search_order,
            'forum_id'     => self::$forum_id,
            'memory_limit' => self::$memory_limit,
            'composevars'  => self::$composevars,
            'rowstart'     => self::$rowstart,
            'search_param' => self::$search_param,
        ];
        return $key === NULL ? $info : (isset($info[$key]) ? $info[$key] : NULL);
    protected function __construct() {
        parent::__construct();
        self::$locale = fusion_get_locale('', LOCALE.LOCALESET.'search.php');
    }

                $qualified_search_text[] = $search_text[$i];

    /**
     * Load the search driver file
     * - Prevents string mutation
     *
     * @param $path
     */
    protected static function __Load($path) {
        include_once($path);
    }
        return descript($value);
        return array_map('descript', $value);


Fixed code:
    public static $locale = [];
    protected static $search_instance = NULL;
    protected function __construct() {
        parent::__construct();
        self::$locale = fusion_get_locale('', LOCALE.LOCALESET.'search.php');
    /**
     * Returns params
     *
     * @param null $key
     *
     * @return array|string
     */
    public static function get_param($key = NULL) {
        $info = [
            'stype'        => htmlentities(self::$search_type),
            'stext'        => htmlentities(self::$search_text),
            'method'       => htmlentities(self::$search_method),
            'datelimit'    => self::$search_date_limit,
            'fields'       => self::$search_fields,
            'sort'         => self::$search_sort,
            'chars'        => htmlentities(self::$search_chars),
            'order'        => self::$search_order,
            'forum_id'     => self::$forum_id,
            'memory_limit' => self::$memory_limit,
            'composevars'  => self::$composevars,
            'rowstart'     => self::$rowstart,
            'search_param' => htmlentities(self::$search_param),
        ];

        return $key === NULL ? $info : (isset($info[$key]) ? $info[$key] : NULL);
    }

                $qualified_search_text[] = htmlentities($search_text[$i]);

    /**
     * Load the search driver file
     * - Prevents string mutation
     *
     * @param $path
     */
    protected static function __Load($path) {
        include_once($path);
    }

        return stripinput($value);
        return array_map('stripinput', $value);