CVE-2017-8876 (PHP, published 2017-05-10T05:29Z)
Description: value: Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/DeuxHuitHuit/symphony-2
Files changed:
symphony/content/content.blueprintssections.php
symphony/content/content.publish.php
symphony/lib/toolkit/class.administrationpage.php
Commit message: Prevent XSS with section's name and nav group

This commit adds sanitization of the section's name and naviguation
group, which permitted authenticated XSS.

Reported by Pradeep Kumar <pradeepch99@gmail.com>

cc @michael-e @brendo


Vulnerable code:
        $label->appendChild(Widget::Input('meta[navigation_group]', $meta['navigation_group']));
                $ul->appendChild(new XMLElement('li', $s->get('navigation_group')));
        $this->setTitle(__('%1$s &ndash; %2$s &ndash; %3$s', array($meta['name'], __('Sections'), __('Symphony'))));
        $this->appendSubheading($meta['name'],
        $label->appendChild(Widget::Input('meta[navigation_group]', $meta['navigation_group']));
                $ul->appendChild(new XMLElement('li', $s->get('navigation_group')));
        $this->setTitle(__('%1$s &ndash; %2$s', array($section->get('name'), __('Symphony'))));
        $this->appendSubheading($section->get('name'), $subheading_buttons);
        $this->setTitle(__('%1$s &ndash; %2$s', array($section->get('name'), __('Symphony'))));
            Widget::Anchor($section->get('name'), SYMPHONY_URL . '/publish/' . $this->_context['section_handle'] . '/' . $this->getFilterString()),
        $this->setTitle(__('%1$s &ndash; %2$s &ndash; %3$s', array($title, $section->get('name'), __('Symphony'))));
            Widget::Anchor($section->get('name'), SYMPHONY_URL . (isset($filter_link) ? $filter_link : $base)),
                $xGroup = new XMLElement('li', $n['name'], array('role' => 'presentation'));
                            $linkChild = Widget::Anchor($c['name'], SYMPHONY_URL . $c['link']);

Fixed code:
        $label->appendChild(Widget::Input('meta[navigation_group]', (isset($meta['navigation_group']) ? General::sanitize($meta['navigation_group']) : null)));
                $ul->appendChild(new XMLElement('li', General::sanitize($s->get('navigation_group'))));
        $this->setTitle(__('%1$s &ndash; %2$s &ndash; %3$s', array(General::sanitize($meta['name']), __('Sections'), __('Symphony'))));
        $this->appendSubheading(General::sanitize($meta['name']),
        $label->appendChild(Widget::Input('meta[navigation_group]', General::sanitize($meta['navigation_group'])));
                $ul->appendChild(new XMLElement('li', General::sanitize($s->get('navigation_group'))));
        $this->setTitle(__('%1$s &ndash; %2$s', array(General::sanitize($section->get('name')), __('Symphony'))));
        $this->appendSubheading(General::sanitize($section->get('name')), $subheading_buttons);
        $this->setTitle(__('%1$s &ndash; %2$s', array(General::sanitize($section->get('name')), __('Symphony'))));
            Widget::Anchor(General::sanitize($section->get('name')), SYMPHONY_URL . '/publish/' . $this->_context['section_handle'] . '/' . $this->getFilterString()),
        $this->setTitle(__('%1$s &ndash; %2$s &ndash; %3$s', array($title, General::sanitize($section->get('name')), __('Symphony'))));
            Widget::Anchor(General::sanitize($section->get('name')), SYMPHONY_URL . (isset($filter_link) ? $filter_link : $base)),
                $xGroup = new XMLElement('li', General::sanitize($n['name']), array('role' => 'presentation'));
                            $linkChild = Widget::Anchor(General::sanitize($c['name']), SYMPHONY_URL . $c['link']);