CVE-2023-4517 (PHP, published 2023-10-13T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
web/templates/pages/edit_server.php
Commit message: Security patch for XSS in Edit server (#3946)

* Add htmlenties to backup forms

* Add some extra checks

Vulnerable code:
									value="<?= $_SESSION["DB_PMA_ALIAS"] ?>"
								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= $_SESSION["DB_PGA_ALIAS"] ?>">
							value="<?= trim($v_backup_dir, "'") ?>"
									value="<?= trim($v_backup_host, "'") ?>"
									value="<?= trim($v_backup_port, "'") ?>"
									value="<?= trim($v_backup_username, "'") ?>"
										value="<?= trim($v_backup_password, "'") ?>"
									value="<?= trim($v_backup_bpath, "'") ?>"
									value="<?= trim($v_backup_bucket, "'") ?>"
									value="<?= trim($v_backup_application_id, "'") ?>"
									value="<?= trim($v_backup_application_key, "'") ?>"
									value="<?= trim($v_rclone_host, "'") ?>"
									value="<?= trim($v_rclone_path, "'") ?>"
							<span class="values-list-value"><?= $v_ssl_subject ?></span>
								<span class="values-list-value"><?= $v_ssl_aliases ?></span>
							<span class="values-list-value"><?= $v_ssl_not_before ?></span>
							<span class="values-list-value"><?= $v_ssl_not_after ?></span>
							<span class="values-list-value"><?= $v_ssl_signature ?></span>
							<span class="values-list-value"><?= $v_ssl_pub_key ?></span>
							<span class="values-list-value"><?= $v_ssl_issuer ?></span>

Fixed code:
									value="<?= htmlentities($_SESSION["DB_PMA_ALIAS"]); ?>"
								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= htmlentities($_SESSION["DB_PGA_ALIAS"]) ?>">
							value="<?= htmlentities(trim($v_backup_dir, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_host, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_port, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_username, "'")) ?>"
										value="<?= htmlentities(trim($v_backup_password, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_bpath, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_bucket, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_application_id, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_application_key, "'")) ?>"
									value="<?= htmlentities(trim($v_rclone_host, "'")) ?>"
									value="<?= htmlentities(trim($v_rclone_path, "'")) ?>"
							<span class="values-list-value"><?= htmlentities($v_ssl_subject) ?></span>
								<span class="values-list-value"><?= htmlentities($v_ssl_aliases) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_not_before) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_not_after) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_signature) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_pub_key) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_issuer) ?></span>