CVE-2015-1562 (PHP, published 2015-02-09T11:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2) data_search parameter to /admin/profile_data.php, or (3) filter parameter to error_log.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sauruscms/Saurus-CMS-Community-Edition
Files changed:
admin/error_log.php
admin/profile_data.php
classes/user_html.inc.php
Commit message: Fix multiple XSS reflection vulnerabilities

discovered by Steffen Rösemann <steffen.roesemann1986@gmail.com>.


Vulnerable code:
	<? foreach($site->fdat as $fdat_field=>$fdat_value) { ?>
	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? $site->fdat['filter'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? $site->fdat['data_search'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
		<input type=hidden name=profile_search value="<?=$site->fdat['profile_search']?>">
		<input type=hidden name=profile_id value="<?=$site->fdat['profile_id']?>">

Fixed code:
	<? foreach($site->fdat as $fdat_field=>$fdat_value) {
	$fdat_value = htmlspecialchars(xss_clean($fdat_value));
	$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
	?>
	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? htmlspecialchars(xss_clean($site->fdat['filter'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? htmlspecialchars(xss_clean($site->fdat['data_search'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
		<input type=hidden name=profile_search value="<?=htmlspecialchars(xss_clean($site->fdat['profile_search']))?>">
		<input type=hidden name=profile_id value="<?=htmlspecialchars(xss_clean($site->fdat['profile_id']))?>">
	$site->fdat['search_subtree'] = htmlspecialchars(xss_clean($site->fdat['search_subtree']));
	$site->fdat['user_search'] = htmlspecialchars(xss_clean($site->fdat['user_search']));
	$site->fdat['group_search'] = htmlspecialchars(xss_clean($site->fdat['group_search']));
	$site->fdat['search'] = htmlspecialchars(xss_clean($site->fdat['search']));