CVE-2023-2947 (PHP, published 2023-05-27T23:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
admin.php
Commit message: fix: bug fix (#6296)



Vulnerable code:
                            echo "  <td>$sfname</td>\n";
                            echo "  <td>$dbase</td>\n";
                                echo "  <td colspan='3'><a href='setup.php?site=$sfname' class='text-decoration-none'>Needs setup, click here to run it</a></td>\n";
                                echo "  <td colspan='3' class='text-danger'>$errmsg</td>\n";
                                echo "  <td>$openemr_name</td>\n";
                                echo "  <td>$openemr_version</td>\n";
                                    echo "  <td><a href='sql_upgrade.php?site=$sfname' class='text-decoration-none'>Upgrade Database</a></td>\n";
                                    echo "  <td><a href='acl_upgrade.php?site=$sfname' class='text-decoration-none'>Upgrade Access Controls</a></td>\n";
                                    echo "  <td><a href='sql_patch.php?site=$sfname' class='text-decoration-none'>Patch Database</a></td>\n";
                                    echo "  <td><a href='interface/login/login.php?site=$sfname' class='text-decoration-none'><i class='fa fa-sign-in-alt fa-lg' aria-hidden='true' data-toggle='tooltip' data-placement='top' title ='Login to site $sfname'></i></a></td>\n";
                                    echo "  <td><a href='portal/index.php?site=$sfname' class='text-decoration-none'><i class='fa fa-sign-in-alt fa-lg' aria-hidden='true' data-toggle='tooltip' data-placement='top' title ='Login to site $sfname'></i></a></td>\n";

Fixed code:
                            echo "  <td>" . htmlspecialchars($sfname, ENT_NOQUOTES) . "</td>\n";
                            echo "  <td>" . htmlspecialchars($dbase, ENT_NOQUOTES) . "</td>\n";
                                echo "  <td colspan='3'><a href='setup.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'>Needs setup, click here to run it</a></td>\n";
                                echo "  <td colspan='3' class='text-danger'>" . htmlspecialchars($errmsg, ENT_NOQUOTES) . "</td>\n";
                                echo "  <td>" . htmlspecialchars($openemr_name, ENT_NOQUOTES) . "</td>\n";
                                echo "  <td>" . htmlspecialchars($openemr_version, ENT_NOQUOTES) . "</td>\n";
                                    echo "  <td><a href='sql_upgrade.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'>Upgrade Database</a></td>\n";
                                    echo "  <td><a href='acl_upgrade.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'>Upgrade Access Controls</a></td>\n";
                                    echo "  <td><a href='sql_patch.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'>Patch Database</a></td>\n";
                                    echo "  <td><a href='interface/login/login.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'><i class='fa fa-sign-in-alt fa-lg' aria-hidden='true' data-toggle='tooltip' data-placement='top' title ='Login to site " . htmlspecialchars($sfname, ENT_QUOTES) . "'></i></a></td>\n";
                                    echo "  <td><a href='portal/index.php?site=" . htmlspecialchars(urlencode($sfname), ENT_QUOTES) . "' class='text-decoration-none'><i class='fa fa-sign-in-alt fa-lg' aria-hidden='true' data-toggle='tooltip' data-placement='top' title ='Login to site " . htmlspecialchars($sfname, ENT_QUOTES) . "'></i></a></td>\n";