CVE-2024-23645 (PHP, published 2024-02-01T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages.  Upgrade to 10.0.12.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
front/stat.location.php
front/stat.tracking.php
src/Stat.php
Commit message: Encode special chars in stats forms/links


Vulnerable code:
    "date1=" . $_GET["date1"] . "&amp;date2=" . $_GET["date2"] .
                     "&amp;itemtype=" . $_GET['itemtype'] . "&amp;dropdown=" . $_GET["dropdown"],
    "date1=" . $_GET["date1"] . "&amp;date2=" . $_GET["date2"] . "&amp;type=" . $_GET["type"] .
                    "&amp;showgraph=" . $_GET["showgraph"] . "&amp;itemtype=" . $_GET["itemtype"] .
                    "&amp;value2=" . $_GET['value2'],
                   // HTML display
                    $link = $_SERVER['PHP_SELF'] .
                       "?date1=$date1&amp;date2=$date2&amp;itemtype=$itemtype&amp;type=$type" .
                       "&amp;value2=0";
                    $link = "<a href='$link'>" . __('Back') . "</a>";
                   // HTML display
                    $link = $_SERVER['PHP_SELF'] .
                       "?date1=$date1&amp;date2=$date2&amp;itemtype=$itemtype&amp;type=$type" .
                       "&amp;value2=" . $value[$i]['id'];
                    $link = "<a href='$link'>" . $value[$i]['link'] . "</a>";
                        $link = "<a href='stat.graph.php?id=" . $value[$i]['id'] .
                            "&amp;date1=$date1&amp;date2=$date2&amp;itemtype=$itemtype&amp;type=$type" .
                            (!empty($value2) ? "&amp;champ=$value2" : "") . "'>" .
                    "date1=" . $date1 . "&amp;date2=" . $date2 .
                                 "&amp;type=hardwares&amp;start=$start",

Fixed code:
    Toolbox::append_params(
        [
            'date1'    => $_GET['date1'],
            'date2'    => $_GET['date2'],
            'itemtype' => $_GET['itemtype'],
            'dropdown' => $_GET['dropdown'],
        ],
        '&amp;'
    ),
    Toolbox::append_params(
        [
            'date1'     => $_GET['date1'],
            'date2'     => $_GET['date2'],
            'type'      => $_GET['type'],
            'showgraph' => $_GET['showgraph'],
            'itemtype'  => $_GET['itemtype'],
            'value2'    => $_GET['value2'],
        ],
        '&amp;'
    ),
                    // HTML display
                    $url = $_SERVER['PHP_SELF'] . '?' . Toolbox::append_params(
                        [
                            'date1'    => $date1,
                            'date2'    => $date2,
                            'itemtype' => $itemtype,
                            'type'     => $type,
                            'value2'   => 0,
                        ],
                        '&amp;'
                    );
                    $link = "<a href='$url'>" . __('Back') . "</a>";
                    // HTML display
                    $url = $_SERVER['PHP_SELF'] . '?' . Toolbox::append_params(
                        [
                            'date1'    => $date1,
                            'date2'    => $date2,
                            'itemtype' => $itemtype,
                            'type'     => $type,
                            'value2'  => $value[$i]['id'],
                        ],
                        '&amp;'
                    );
                    $link = "<a href='$url'>" . $value[$i]['link'] . "</a>";
                        $url = 'stat.graph.php?' . Toolbox::append_params(
                            [
                                'date1'    => $date1,
                                'date2'    => $date2,
                                'itemtype' => $itemtype,
                                'type'     => $type,
                                'champ'    => $value2,
                            ],
                            '&amp;'
                        );
                        $link = "<a href='$url'>" .
                    Toolbox::append_params(
                        [
                            'date1'     => $date1,
                            'date2'     => $date2,
                            'type'      => 'hardwares',
                            'start'     => $start,
                        ],
                        '&amp;'
                    ),