hitoshura25/cvefixes huggingface dataset:
CVE-2023-4321 (PHP, published 2023-08-14T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: prevent xhtml files from being uploaded in the assets manager


Vulnerable code:
- Prevent uploading .phps + .html files in assets manager
        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
        $forbiddenMime = ['application/x-httpd-php', 'text/html'];

Fixed code:
- Prevent uploading .phps + .(x)html files in assets manager
        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'xhtml', 'htaccess'];
        $forbiddenMime = [
            'application/x-httpd-php', 'application/x-php', 'text/x-php',
            'text/html', 'application/xhtml+xml'
        ];
CVE-2023-4395 (PHP, published 2023-08-17T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: Fix mime type detection on asset upload


Vulnerable code:
                $_mime = finfo_file($finfo, $_file);
                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||

Fixed code:
## WIP

- Fix mime type detection on asset upload

                $_mime = $finfo->file($files['tmp_name'][$i]);
                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));

                    in_array($extension, $forbiddenExtension) ||
CVE-2023-4422 (PHP, published 2023-08-18T19:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
modules/Assets/bootstrap.php
Commit message: make assets uploading more secure


Vulnerable code:
        $_files    = [];
        $forbidden = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
                // prevent uploading php files
                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbidden)) {

Fixed code:
        $finfo      = finfo_open(FILEINFO_MIME_TYPE);
        $_files     = [];
        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
        $forbiddenMime = ['application/x-httpd-php', 'text/html'];
                $_mime = finfo_file($finfo, $_file);
                // prevent uploading php / html files
                if ($_isAllowed && (
                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||
                    in_array(strtolower($_mime), $forbiddenMime)
                )) {
CVE-2023-4432 (PHP, published 2023-08-19T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/System/views/api/graphql-viewer.php
modules/System/views/api/rest-api-viewer.php
Commit message: Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer


Vulnerable code:
  <input id="apiKey" type="text" placeholder="API Key" value="<?=($apiKey ? $apiKey : '')?>">
  fill: <?=($primaryColor ? $primaryColor : '#0e8fff')?>;
        spec-url="<?=$openApiUrl?>"
        api-key-value = "<?=$apiKey?>"
        bg-color="<?=($bgColor ? $bgColor : '#10131a')?>"
        text-color="<?=($textColor ? $textColor : '#fafafa')?>"
        primary-color="<?=($primaryColor ? $primaryColor : '#0e8fff')?>"

Fixed code:
- Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer
  <input id="apiKey" type="text" placeholder="API Key" value="<?=$this->escape($apiKey ? $apiKey : '')?>">
  fill: <?= $this->escape($primaryColor ? $primaryColor : '#0e8fff')?>;
        spec-url="<?=$this->escape($openApiUrl)?>"
        api-key-value = "<?=$this->escape($apiKey)?>"
        bg-color="<?=$this->escape($bgColor ? $bgColor : '#10131a')?>"
        text-color="<?= $this->escape($textColor ? $textColor : '#fafafa')?>"
        primary-color="<?= $this->escape($primaryColor ? $primaryColor : '#0e8fff')?>"
CVE-2023-4433 (PHP, published 2023-08-19T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: Fix mime type detection on asset upload


Vulnerable code:
                $_mime = finfo_file($finfo, $_file);
                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||

Fixed code:
## WIP

- Fix mime type detection on asset upload

                $_mime = $finfo->file($files['tmp_name'][$i]);
                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));

                    in_array($extension, $forbiddenExtension) ||
CVE-2023-4451 (PHP, published 2023-08-20T15:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
install/index.php
Commit message: sanitize space name during installation


Vulnerable code:
    $APP_SPACE = $_GET['space'];

Fixed code:
- Sanitize space name during installation
    $APP_SPACE = preg_replace('/[^a-z0-9\-_]/', '', $_GET['space']);
CVE-2023-34236 (Go, published 2023-07-14T22:15Z)
Description: value: Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability. As a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/weaveworks/tf-controller
Files changed:
runner/server_outputs.go
Commit message: fix loggin in tf.output

Signed-off-by: Chanwit Kaewkasi <chanwit@gmail.com>


Vulnerable code:
	outputs, err := r.tf.Output(ctx)

Fixed code:
	"io"
	"github.com/hashicorp/terraform-exec/tfexec"
func (r *TerraformRunnerServer) tfOutput(ctx context.Context, opts ...tfexec.OutputOption) (map[string]tfexec.OutputMeta, error) {
	log := ctrl.LoggerFrom(ctx, "instance-id", r.InstanceID).WithName(loggerName)

	// This is the only place where we disable the logger
	r.tf.SetStdout(io.Discard)
	r.tf.SetStderr(io.Discard)

	defer r.initLogger(log)

	return r.tf.Output(ctx, opts...)
}

	outputs, err := r.tfOutput(ctx)
CVE-2023-27560 (PHP, published 2023-03-03T06:15Z)
Description: value: Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/phpseclib/phpseclib
Files changed:
phpseclib/Math/PrimeField.php
phpseclib/Math/PrimeField/Integer.php
Commit message: PrimeField: prevent infinite loop with composite primefields


Vulnerable code:
        //if (!$modulo->isPrime()) {
        //    throw new \UnexpectedValueException('PrimeField requires a prime number be passed to the constructor');
        //}
            $i = clone $one;

            while (!$t->powMod($two->pow($i), static::$modulo[$this->instanceID])->equals($one)) {
                $i = $i->add($one);
            if ($i->compare($m) >= 0) {

Fixed code:
        if (!$modulo->isPrime()) {
            throw new \UnexpectedValueException('PrimeField requires a prime number be passed to the constructor');
        }
            for ($i == clone $one; $i->compare($m) < 0; $i = $i->add($one)) {
                if ($t->powMod($two->pow($i), static::$modulo[$this->instanceID])->equals($one)) {
                    break;
                }
            if ($i->compare($m) == 0) {
CVE-2023-49316 (PHP, published 2023-11-27T18:15Z)
Description: value: In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/phpseclib/phpseclib
Files changed:
phpseclib/Math/BinaryField.php
tests/Unit/Crypt/EC/KeyTest.php
Commit message: Math/BinaryField: fix for excessively large degrees


Vulnerable code:

Fixed code:
        if ($m > 571) {
            /* sect571r1 and sect571k1 are the largest binary curves that https://www.secg.org/sec2-v2.pdf defines
               altho theoretically there may be legit reasons to use binary finite fields with larger degrees
               imposing a limit on the maximum size is both reasonable and precedented. in particular,
               http://tools.ietf.org/html/rfc4253#section-6.1 (The Secure Shell (SSH) Transport Layer Protocol) says
               "implementations SHOULD check that the packet length is reasonable in order for the implementation to
                avoid denial of service and/or buffer overflow attacks" */
            throw new \OutOfBoundsException('Degrees larger than 571 are not supported');
        }

    public function testExcessivelyLargeBinaryField()
    {
        $this->expectException('\OutOfBoundsException');

        $key = '-----BEGIN PUBLIC KEY-----
MIIBDDCB0wYHKoZIzj0CATCBxwIBATAgBgcqhkjOPQECMBUCBH////8GCSqGSM49
AQIDAgICAMEwTQQZABeFj+t6mJdRaeFx93tAh94JisipEd97AQQZAP37Sb/mw6if
rK2qeh5bvHzBwuXYMUeIFAMVABA/rsdNaW5naHVhUXV3f8Wxke8wBDMEAfSBvF8P
+Ep0rWzfb970v2F5YlNy2MDF4QAl45nykDcSzPPqnjoa0X+wsyAbavfOGwUCGQEA
AAAAAAAAAAAAAADH80p3j0Q6zJIOukkCAQIDNAAEAE2mUTAwdPK952h3G8ZinK8B
z9DYTLdGkQDqox3AtEs9nn6kE1O/vHE4bqMegjj4gbA=
-----END PUBLIC KEY-----';
        $key = EC::loadFormat('PKCS8', $key);
        $this->assertInstanceOf(PublicKey::class, $key);
    }
CVE-2022-25896 (JavaScript, published 2022-07-01T20:15Z)
Description: value: This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
Severity: MEDIUM (CVSS v3 base score: 4.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/jaredhanson/passport
Files changed:
lib/sessionmanager.js
Commit message: Regenerate session on login.


Vulnerable code:
  this._serializeUser(user, req, function(err, obj) {
    // TODO: Error if session isn't available here.
    if (!req.session) {
      req.session = {};
    }
    if (!req.session[self._key]) {
      req.session[self._key] = {};
    }
    req.session[self._key].user = obj;
    cb();

Fixed code:
  console.log('SM: logIn');
  
  req.session.regenerate(function(err) {
    
    self._serializeUser(user, req, function(err, obj) {
      if (err) {
        return cb(err);
      }
      // TODO: Error if session isn't available here.
      if (!req.session) {
        req.session = {};
      }
      if (!req.session[self._key]) {
        req.session[self._key] = {};
      }
      req.session[self._key].user = obj;
      cb();
    });
  console.log('SM: logOut');
CVE-2019-11411 (C, published 2019-04-22T11:29Z)
Description: value: An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ccxvii/mujs
Files changed:
jsnumber.c
Commit message: Bug 700938: Fix stack overflow in numtostr as used by Number#toFixed().

32 is not enough to fit sprintf("%.20f", 1e20).
We need at least 43 bytes to fit that format.
Bump the static buffer size.


Vulnerable code:
	char buf[32];
		char buf[100];
	char buf[32], *e;

Fixed code:
	char buf[100];
	/* buf needs to fit printf("%.20f", 1e20) */
	char buf[50], *e;
CVE-2019-11412 (C, published 2019-04-22T11:29Z)
Description: value: An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDTRY opcode call.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-670 \u2014 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Repository: https://github.com/ccxvii/mujs
Files changed:
jscompile.c
Commit message: Bug 700947: Add missing ENDTRY opcode in try/catch/finally byte code.

In one of the code branches in handling exceptions in the catch block
we forgot to call the ENDTRY opcode to pop the inner hidden try.
This leads to an unbalanced exception stack which can cause a crash
due to us jumping to a stack frame that has already been exited.


Vulnerable code:

Fixed code:
		emit(J, F, OP_ENDTRY);
CVE-2021-33796 (C, published 2023-07-07T18:15Z)
Description: value: In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ccxvii/mujs
Files changed:
jsrun.c
Commit message: Fix use-after-free in regexp source property access.

The underlying string of the "source" property of a regular expression
object can be freed if the regexp is garbage collected.

This could lead to a use-after-free, because the accessor incorrectly
assumed that the regexp source was an interned (thus never freed) string.
Fix this by calling js_pushstring instead of the faster but unsafe
js_pushliteral.

Many thanks to Connor Nelson for spotting this!


Vulnerable code:
			js_pushliteral(J, obj->u.r.source);

Fixed code:
			js_pushstring(J, obj->u.r.source);
CVE-2021-33797 (C, published 2023-04-17T22:15Z)
Description: value: Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which leads to a buffer overflow in the pointer *d.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ccxvii/mujs
Files changed:
jsdtoa.c
Commit message: Issue #148: Check for overflow when reading floating point exponent.

GCC with -O2 optimizes away the if(exp<-maxExponent) branch completely,
so we don't end up with the expected '512' value for overflowing
exponents. Limit the exponent parsing to MAX_INT instead to prevent
signed overflow from tripping up over-eager optimizing compilers.


Vulnerable code:
		while ((*p >= '0') && (*p <= '9')) {

Fixed code:
		while ((*p >= '0') && (*p <= '9') && exp < INT_MAX/10) {
		while ((*p >= '0') && (*p <= '9'))
			p += 1;
CVE-2021-45005 (C, published 2022-02-14T22:15Z)
Description: value: Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ccxvii/mujs
Files changed:
jscompile.c
Commit message: Bug 704749: Clear jump list after patching jump addresses.

Since we can emit a statement multiple times when compiling try/finally
we have to use a new patch list for each instance.


Vulnerable code:
static void labeljumps(JF, js_JumpList *jump, int baddr, int caddr)
		jump = jump->next;
		labeljumps(J, F, stm->jumps, here(J,F), cont);
		labeljumps(J, F, stm->jumps, here(J,F), loop);
		labeljumps(J, F, stm->jumps, here(J,F), cont);
		labeljumps(J, F, stm->jumps, here(J,F), loop);
		labeljumps(J, F, stm->jumps, here(J,F), 0);
			labeljumps(J, F, stm->jumps, here(J,F), 0);

Fixed code:
static void labeljumps(JF, js_Ast *stm, int baddr, int caddr)
	js_JumpList *jump = stm->jumps;
		js_JumpList *next = jump->next;
		js_free(J, jump);
		jump = next;
	stm->jumps = NULL;
		labeljumps(J, F, stm, here(J,F), cont);
		labeljumps(J, F, stm, here(J,F), loop);
		labeljumps(J, F, stm, here(J,F), cont);
		labeljumps(J, F, stm, here(J,F), loop);
		labeljumps(J, F, stm, here(J,F), 0);
			labeljumps(J, F, stm, here(J,F), 0);
CVE-2022-44789 (C, published 2022-11-23T21:15Z)
Description: value: A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ccxvii/mujs
Files changed:
jsobject.c
Commit message: Bug 706057: Fix use-after-free in getOwnPropertyDescriptor.

getOwnPropertyDescriptor should create the descriptor object by
using [[DefineOwnProperty]], and not by looking through the prototype
chain where it may invoke getters and setters on the Object.prototype.

If there exists an Object.prototype.get property with a setter, that method is
invoked when it shouldn't. A malicious getter here can delete the property
currently being processed in getOwnPropertyDescriptor, and we'll end up
with a use-after-free bug.

Avoid this problem by following the spec and use js_defproperty rather than
js_setproperty to define own properties in getOwnPropertyDescriptor and
related functions.


Vulnerable code:
			js_setproperty(J, -2, "value");
			js_setproperty(J, -2, "writable");
			js_setproperty(J, -2, "get");
			js_setproperty(J, -2, "set");
		js_setproperty(J, -2, "enumerable");
		js_setproperty(J, -2, "configurable");
		js_setproperty(J, -3, name);

Fixed code:
			js_defproperty(J, -2, "value", 0);
			js_defproperty(J, -2, "writable", 0);
			js_defproperty(J, -2, "get", 0);
			js_defproperty(J, -2, "set", 0);
		js_defproperty(J, -2, "enumerable", 0);
		js_defproperty(J, -2, "configurable", 0);
		js_defproperty(J, -3, name, 0);
CVE-2014-4908 (PHP, published 2014-07-11T11:08Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lingej/pnp4nagios
Files changed:
share/pnp/application/views/template.php
Commit message: Plug potential XSS hole in views/template.php

REQUEST_URI needs to be sanitized if used. Since we want to refresh
to the same page there is no need to set the URI.

Signed-off-by: Mikael Falkvidd <mfalkvidd@op5.com>


Vulnerable code:
<meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>; url=<?php echo $_SERVER['REQUEST_URI'] ?>" />

Fixed code:
<meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>" />