CVE-2020-36608 (PHP, published 2022-11-02T19:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is dfd0afacb26c3682a847bea7b49ea440b63f3baa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-212816.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TribalSystems/Zenario
Files changed:
zenario/admin/db_updates/latest_revision_no.inc.php
zenario/autoload/welcome.php
zenario/js/admin_organizer.js
zenario/js/admin_organizer.min.js
zenario/modules/zenario_forum/module_code.php
zenario/styles/admin_organizer.css
zenario/styles/admin_organizer.min.css
Commit message: Fix for a security vulnerability with the Error Log module

This patch prevents an XSS attack, where an attacker with hacking tools could enter
<script> tags and JavaScript code as their referer URL and then navigate to a page on
your site that did not exist, and their JavaScript code would be executed when an
admin next visited the error log page in Organizer.

This commit also includes some various other miscellaneous fixes.

Vulnerable code:
define('ZENARIO_REVISION', '50977');
				$fields['0/htaccess_unavailable']['snippet']['html'] = \ze\admin::phrase('The .htaccess file cannot be read or is missing. (This message needs revising.)');
						href += ' title="' + htmlspecialchars(item.name) + '|"';
						href += ' title="' + htmlspecialchars(item.name) + '|"';
							href += ' title="' + htmlspecialchars(item.name) + '|' + phrase.clkToViewLinkedMenuNode + '"';
							href += ' title="' + htmlspecialchars(item.name) + '|' + phrase.clkToViewLinkedCItem + '"';
						href += ' title="' + htmlspecialchars(item.name) + '|' + phrase.clkToViewLinkInNewWindow + '"';
						itemName = item.name;
D._sort_desc=v(a._fPOM(b,"default_sort_desc")))}x&&!_._isEm(x)&&(D._filters=JSON.stringify(x));(L||a.CSVExport)&&r(G)&&(D._search=G)}if(B)return K+w._uR(D);a._stRe();b!=a.defaultPathInIframePreload&&(m("organizer_preloader_circle").style.display="block");r(l.zenarioOFirstLoad)&&(l.zenarioOFirstLoad?l.zenarioOFirstLoad=!1:a._rOIIR(b));K?w._a(K+w._uR(D),!1,!0,!0,!0,!0).after(A):A(F)}}else l.zenarioONotFull||(l.zenarioOQueue=[{path:b,branch:-1}])}};a.go2=function(b,c,d,e,f,g,h,s,F,m,u,t,G,x,B,y,A,z,
1].panel_instances[a.path]=u;r(E._filters)&&(G=E._filters,delete E._filters);a.branches[a.branches.length-1].filters[a.path]=G;a._sS(t);delete a.tuix;a.tuix=E;a.focus=a.tuix;a.pi.cmsSetsPanelTUIX(a.tuix);a.filtersSet=!1;a.filtersSetInViewOptions=!1;for(var J in G)if(p(G,J)&&a._fSOC(J,G)&&(a.filtersSet=!0,a._cFC(J))){a.filtersSetInViewOptions=!0;break}a._mIVIF();a._sR(x);a.lastRefiners=y;a.tuix.columns||(a.tuix.columns={name:{title:"Name"}});(c=a._fPOM(b,"reorder"))&&c.column?(a.sortBy=c.column,a.sortDesc=
(a.contentItems[C][P]={}),c=M+"zenario/admin/organizer.ajax.php?path="+a.shallowLinks.content_item+"&_get_item_links="+L[C][P]+"&languageId="+T(C),++a.itemLinkRequestsLeft,a._gDH(c,C,function(b,c){g==a.goNum&&(a.contentItems[b][P]=c,--a.itemLinkRequestsLeft||a.go3(g,t,z,I))}));for(C in K)p(K,C)&&(J=K[C])&&(a.menuItems[C]||(a.menuItems[C]={}),c=M+"zenario/admin/organizer.ajax.php?path="+a.shallowLinks.menu_item+"&_get_item_links="+T(J)+"&languageId="+T(C)+"&refinerName=language&refinerId="+T(C)+"&refiner__language="+
T(C),++a.itemLinkRequestsLeft,a._gDH(c,C,function(b,c){g==a.goNum&&(a.menuItems[b]=c,--a.itemLinkRequestsLeft||a.go3(g,t,z,I))}));for(b in H)p(H,b)&&(J=H[b])&&(a.otherItemLinks[b]||(a.otherItemLinks[b]={}),c=M+"zenario/admin/organizer.ajax.php?path="+T(b)+"&_get_item_links="+T(J),++a.itemLinkRequestsLeft,a._gDH(c,b,function(b,c){g==a.goNum&&(a.otherItemLinks[b]=c,--a.itemLinkRequestsLeft||a.go3(g,t,z,I))}));a.itemLinkRequestsLeft?(a.go3Timeout&&clearTimeout(a.go3Timeout),a.go3Timeout=setTimeout(function(){a.go3(g,
t,z,I)},a.getItemLinkTimeoutTime)):a.go3(g,t,z,I)}}};a.getDataHack=function(a,c,d){w._a(a,2E3<a.length,!0,!0,!0).after(function(a){d(c,a)})};a.go3=function(b,c,d,e){(q.isFullOrganizerWindow||q._cIBIO("og"))&&b==a.goNum&&(a.lastSuccessfulGoNum=++a.goNum,a.go3Timeout&&clearTimeout(a.go3Timeout),m("organizer_preloader_circle").style.display="none",a._sN(),!d&&a.tuix.popout_message&&(r(a.refreshToPage)&&a.tuix.popout_message==a.lastPopoutMessage||q._sM(a.tuix.popout_message,!0,!1),a.lastPopoutMessage=
a.otherItemLinks[g]&&(k=a.otherItemLinks[g].items)&&(k=k[f])}if(k){if(d)return k.name;d="";if(a.tuix.items[b].cell_css_classes&&a.tuix.items[b].cell_css_classes[c]&&-1!=(""+a.tuix.items[b].cell_css_classes[c]).indexOf("ghost"))if(d=' style="cursor: default;"',"menu_item"==g)d+=' title="'+t(k.name)+'|"';else{if("content_item"==g||"content_item_or_url"==g)d+=' title="'+t(k.name)+'|"'}else if(h&&!l.zenarioONotFull?(c="",e=a.shallowLinks[g]||g,d=k.navigation_path?k.navigation_path:a.shallowLinks[g]?a.shallowLinks[g]+
"//"+f:g+"//"+f,a.shallowLinks[g]&&(c=", name: 'following_item_link', languageId: '"+t(a._iL(b))+"'"),d=' href="organizer.php#'+t(d)+'" onclick="zenarioO._dAI();var selectedItems = {};selectedItems[\''+t(b)+"'] = true;zenarioO.pi.cmsSetsSelectedItems(selectedItems);zenarioO._sH();zenarioO.go('"+t(e)+"', true, {id: '"+t(f)+"'"+c+"}, undefined, undefined, undefined, undefined, '"+t(f)+"');return zenario._st(event);\""):k.navigation_path?d=' href="'+M+"zenario/admin/organizer.php#/"+t(k.navigation_path)+
'" target="_blank"':(h=!1,k.frontend_link&&(s=!0,d=' href="'+t(w._aBP(k.frontend_link))+'" target="_blank"')),h)if("menu_item"==g)d+=' title="'+t(k.name)+"|"+y.clkToViewLinkedMenuNode+'"';else{if("content_item"==g||"content_item_or_url"==g)d+=' title="'+t(k.name)+"|"+y.clkToViewLinkedCItem+'"'}else s&&(d+=' title="'+t(k.name)+"|"+y.clkToViewLinkInNewWindow+'"');switch(g){case "content_item":case "content_item_or_url":b=k.name;break;case "menu_item":b=t(k.name);h=b.r(/.*?\-\&gt\; /g,"-&gt; ");h==b&&
(h=b.r(/.*?\: /g,""));b=h;break;default:b=q._fOIN(a.otherItemLinks[g],f)}return u._mT("zenario_organizer_item_link",{item:k,item_link:g,itemName:b,href:d,panel:a.otherItemLinks[g],value:f})}}if(e.format||e.empty_value)f=q._fSIF(f,e);g=e.length_limit&&f.length>e.length_limit;return d?g?f.substr(0,e.length_limit)+"...":f:g?'<span class="tooltip" title="'+t(f)+'">'+t(f.substr(0,e.length_limit))+"...</span>":t(f)};a.rowCssClass=function(b){b=a.tuix.items[b]||{};return b.row_class||b.row_css_class||""};
a.columnCssClass=function(b,c){var d="",e=a.tuix.columns[b],f=r(c)&&a.tuix.items[c];e&&e.css_class&&(d+=" "+e.css_class);f&&f.cell_css_classes&&f.cell_css_classes[b]&&(d+=" "+f.cell_css_classes[b]);f&&f[b]&&e&&e.values&&e.values[f[b]]&&e.values[f[b]].css_class&&(d+=" "+e.values[f[b]].css_class);return d};a.setBackButton=function(){var b,c="",d=a._gBBT(-1,!0),e={buttons:[]};if(d&&0!=d.length){m("organizer_branding_title").style.display="none";m("organizer_backButton").style.display="block";for(b in d)p(d,
					$this->manageOneUpload($postId, $filesToUpload['tmp_name'][$i], $filesToUpload['name'][$i]);
#organizer_quickFilter ul ul{width:200px;z-index:90 !important;position:absolute;top:38px;left:0;margin:0 auto;padding:0 0 5px}#organizer_quickFilter ul ul li{padding:0;border-top:1px solid #747474;border-bottom:1px solid #000;margin:0 5px}
#organizer_quickFilter ul ul li:first-child{border-top:0}#organizer_quickFilter ul ul li:last-child{border-bottom:0}#organizer_quickFilter ul li ul li ul{top:0;left:100%}
#organizer_quickFilter ul ul,#organizer_quickFilter ul li:hover ul ul{display:none}#organizer_quickFilter ul li:hover ul{display:block}#organizer_quickFilter ul ul{background:#333;border:1px solid #333;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 0 3px 0 #d6d6d6;box-shadow:0 0 3px 0 #d6d6d6}

Fixed code:
define('ZENARIO_REVISION', '51340');
				$fields['0/htaccess_unavailable']['snippet']['html'] = \ze\admin::phrase('The .htaccess file cannot be read or is missing.');
				
				$fields['0/friendly_urls_disabled']['hidden'] = true;
						href += ' title="' + htmlspecialchars(htmlspecialchars(item.name)) + '|"';
						href += ' title="' + htmlspecialchars(htmlspecialchars(item.name)) + '|"';
							href += ' title="' + htmlspecialchars(htmlspecialchars(item.name)) + '|' + phrase.clkToViewLinkedMenuNode + '"';
							href += ' title="' + htmlspecialchars(htmlspecialchars(item.name)) + '|' + phrase.clkToViewLinkedCItem + '"';
						href += ' title="' + htmlspecialchars(htmlspecialchars(item.name)) + '|' + phrase.clkToViewLinkInNewWindow + '"';
						itemName = htmlspecialchars(item.name);
D._sort_desc=v(a._fPOM(b,"default_sort_desc")))}x&&!_._isEm(x)&&(D._filters=JSON.stringify(x));(L||a.CSVExport)&&r(G)&&(D._search=G)}if(B)return K+w._uR(D);a._stRe();b!=a.defaultPathInIframePreload&&(m("organizer_preloader_circle").style.display="block");r(l.zenarioOFirstLoad)&&(l.zenarioOFirstLoad?l.zenarioOFirstLoad=!1:a._rOIIR(b));K?w._a(K+w._uR(D),!1,!0,!0,!0,!0).after(A):A(F)}}else l.zenarioONotFull||(l.zenarioOQueue=[{path:b,branch:-1}])}};a.go2=function(b,c,d,e,f,g,h,s,F,m,t,u,G,x,B,y,A,z,
1].panel_instances[a.path]=t;r(E._filters)&&(G=E._filters,delete E._filters);a.branches[a.branches.length-1].filters[a.path]=G;a._sS(u);delete a.tuix;a.tuix=E;a.focus=a.tuix;a.pi.cmsSetsPanelTUIX(a.tuix);a.filtersSet=!1;a.filtersSetInViewOptions=!1;for(var J in G)if(p(G,J)&&a._fSOC(J,G)&&(a.filtersSet=!0,a._cFC(J))){a.filtersSetInViewOptions=!0;break}a._mIVIF();a._sR(x);a.lastRefiners=y;a.tuix.columns||(a.tuix.columns={name:{title:"Name"}});(c=a._fPOM(b,"reorder"))&&c.column?(a.sortBy=c.column,a.sortDesc=
(a.contentItems[C][P]={}),c=M+"zenario/admin/organizer.ajax.php?path="+a.shallowLinks.content_item+"&_get_item_links="+L[C][P]+"&languageId="+T(C),++a.itemLinkRequestsLeft,a._gDH(c,C,function(b,c){g==a.goNum&&(a.contentItems[b][P]=c,--a.itemLinkRequestsLeft||a.go3(g,u,z,I))}));for(C in K)p(K,C)&&(J=K[C])&&(a.menuItems[C]||(a.menuItems[C]={}),c=M+"zenario/admin/organizer.ajax.php?path="+a.shallowLinks.menu_item+"&_get_item_links="+T(J)+"&languageId="+T(C)+"&refinerName=language&refinerId="+T(C)+"&refiner__language="+
T(C),++a.itemLinkRequestsLeft,a._gDH(c,C,function(b,c){g==a.goNum&&(a.menuItems[b]=c,--a.itemLinkRequestsLeft||a.go3(g,u,z,I))}));for(b in H)p(H,b)&&(J=H[b])&&(a.otherItemLinks[b]||(a.otherItemLinks[b]={}),c=M+"zenario/admin/organizer.ajax.php?path="+T(b)+"&_get_item_links="+T(J),++a.itemLinkRequestsLeft,a._gDH(c,b,function(b,c){g==a.goNum&&(a.otherItemLinks[b]=c,--a.itemLinkRequestsLeft||a.go3(g,u,z,I))}));a.itemLinkRequestsLeft?(a.go3Timeout&&clearTimeout(a.go3Timeout),a.go3Timeout=setTimeout(function(){a.go3(g,
u,z,I)},a.getItemLinkTimeoutTime)):a.go3(g,u,z,I)}}};a.getDataHack=function(a,c,d){w._a(a,2E3<a.length,!0,!0,!0).after(function(a){d(c,a)})};a.go3=function(b,c,d,e){(q.isFullOrganizerWindow||q._cIBIO("og"))&&b==a.goNum&&(a.lastSuccessfulGoNum=++a.goNum,a.go3Timeout&&clearTimeout(a.go3Timeout),m("organizer_preloader_circle").style.display="none",a._sN(),!d&&a.tuix.popout_message&&(r(a.refreshToPage)&&a.tuix.popout_message==a.lastPopoutMessage||q._sM(a.tuix.popout_message,!0,!1),a.lastPopoutMessage=
a.otherItemLinks[g]&&(k=a.otherItemLinks[g].items)&&(k=k[f])}if(k){if(d)return k.name;d="";if(a.tuix.items[b].cell_css_classes&&a.tuix.items[b].cell_css_classes[c]&&-1!=(""+a.tuix.items[b].cell_css_classes[c]).indexOf("ghost"))if(d=' style="cursor: default;"',"menu_item"==g)d+=' title="'+t(t(k.name))+'|"';else{if("content_item"==g||"content_item_or_url"==g)d+=' title="'+t(t(k.name))+'|"'}else if(h&&!l.zenarioONotFull?(c="",e=a.shallowLinks[g]||g,d=k.navigation_path?k.navigation_path:a.shallowLinks[g]?
a.shallowLinks[g]+"//"+f:g+"//"+f,a.shallowLinks[g]&&(c=", name: 'following_item_link', languageId: '"+t(a._iL(b))+"'"),d=' href="organizer.php#'+t(d)+'" onclick="zenarioO._dAI();var selectedItems = {};selectedItems[\''+t(b)+"'] = true;zenarioO.pi.cmsSetsSelectedItems(selectedItems);zenarioO._sH();zenarioO.go('"+t(e)+"', true, {id: '"+t(f)+"'"+c+"}, undefined, undefined, undefined, undefined, '"+t(f)+"');return zenario._st(event);\""):k.navigation_path?d=' href="'+M+"zenario/admin/organizer.php#/"+
t(k.navigation_path)+'" target="_blank"':(h=!1,k.frontend_link&&(s=!0,d=' href="'+t(w._aBP(k.frontend_link))+'" target="_blank"')),h)if("menu_item"==g)d+=' title="'+t(t(k.name))+"|"+y.clkToViewLinkedMenuNode+'"';else{if("content_item"==g||"content_item_or_url"==g)d+=' title="'+t(t(k.name))+"|"+y.clkToViewLinkedCItem+'"'}else s&&(d+=' title="'+t(t(k.name))+"|"+y.clkToViewLinkInNewWindow+'"');switch(g){case "content_item":case "content_item_or_url":b=t(k.name);break;case "menu_item":b=t(k.name);h=b.r(/.*?\-\&gt\; /g,
"-&gt; ");h==b&&(h=b.r(/.*?\: /g,""));b=h;break;default:b=q._fOIN(a.otherItemLinks[g],f)}return u._mT("zenario_organizer_item_link",{item:k,item_link:g,itemName:b,href:d,panel:a.otherItemLinks[g],value:f})}}if(e.format||e.empty_value)f=q._fSIF(f,e);g=e.length_limit&&f.length>e.length_limit;return d?g?f.substr(0,e.length_limit)+"...":f:g?'<span class="tooltip" title="'+t(f)+'">'+t(f.substr(0,e.length_limit))+"...</span>":t(f)};a.rowCssClass=function(b){b=a.tuix.items[b]||{};return b.row_class||b.row_css_class||
""};a.columnCssClass=function(b,c){var d="",e=a.tuix.columns[b],f=r(c)&&a.tuix.items[c];e&&e.css_class&&(d+=" "+e.css_class);f&&f.cell_css_classes&&f.cell_css_classes[b]&&(d+=" "+f.cell_css_classes[b]);f&&f[b]&&e&&e.values&&e.values[f[b]]&&e.values[f[b]].css_class&&(d+=" "+e.values[f[b]].css_class);return d};a.setBackButton=function(){var b,c="",d=a._gBBT(-1,!0),e={buttons:[]};if(d&&0!=d.length){m("organizer_branding_title").style.display="none";m("organizer_backButton").style.display="block";for(b in d)p(d,
					if (empty($filesToUpload['error'][$i])) {
						$this->manageOneUpload($postId, $filesToUpload['tmp_name'][$i], $filesToUpload['name'][$i]);
					}
	max-height:70vh;
	overflow-y:auto;
#organizer_quickFilter ul ul{width:200px;z-index:90 !important;position:absolute;top:38px;left:0;margin:0 auto;padding:0 0 5px;max-height:70vh;overflow-y:auto}
#organizer_quickFilter ul ul li{padding:0;border-top:1px solid #747474;border-bottom:1px solid #000;margin:0 5px}#organizer_quickFilter ul ul li:first-child{border-top:0}
#organizer_quickFilter ul ul li:last-child{border-bottom:0}#organizer_quickFilter ul li ul li ul{top:0;left:100%}#organizer_quickFilter ul ul,#organizer_quickFilter ul li:hover ul ul{display:none}
#organizer_quickFilter ul li:hover ul{display:block}#organizer_quickFilter ul ul{background:#333;border:1px solid #333;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 0 3px 0 #d6d6d6;box-shadow:0 0 3px 0 #d6d6d6}