CVE-2014-125100 (PHP, published 2023-05-02T02:15Z)
Description: value: A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/job-board
Files changed:
bws_menu/bws_menu.php
job-board.php
readme.txt
Commit message: V1.0.1 - Security Exploit was fixed.

git-svn-id: https://plugins.svn.wordpress.org/job-board/trunk@962207 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
* Version: 1.3.6
				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
				$message_text .= '</table>
				<h4>Active Plugins</h4>
				<table>';
				foreach ( $system_info['active_plugins'] as $key => $value ) {	
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
				$message_text .= '</table>
				<h4>Inactive Plugins</h4>
				<table>';
				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
				$message_text .= '</table></body></html>';
						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
							<tr>
								<td scope="row"><?php echo $key; ?></td>
								<td scope="row"><?php echo $value; ?></td>
							</tr>	
						<?php } ?>
Version: 1.0.0
				$jbbrd_options['vacancy_reply_text'] = $_POST['vacancy_reply_text'];
						$date_compl = $_POST[ $key ];
						$value =  $_POST[ $key ];
Tested up to: 3.9.1
Stable tag: 1.0.0
Login/registration form bugs were fixed. Session bugs were fixed.

Fixed code:
* Version: 1.3.7
				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
				$message_text .= '</table>';
				if ( ! empty( $system_info['active_plugins'] ) ) {
					$message_text .= '<h4>Active Plugins</h4>
					<table>';
					foreach ( $system_info['active_plugins'] as $key => $value ) {	
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
					}
					$message_text .= '</table>';
				if ( ! empty( $system_info['inactive_plugins'] ) ) {
					$message_text .= '<h4>Inactive Plugins</h4>
					<table>';
					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
					}
					$message_text .= '</table>';
				$message_text .= '</body></html>';
						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
								<tr>
									<td scope="row"><?php echo $key; ?></td>
									<td scope="row"><?php echo $value; ?></td>
								</tr>	
							<?php }
						} ?>
Version: 1.0.1
				$jbbrd_options['vacancy_reply_text'] = stripslashes( esc_html( $_POST['vacancy_reply_text'] ) );
						$date_compl = stripslashes( esc_html( $_POST[ $key ] ) );
						$value =  stripslashes( esc_html( $_POST[ $key ] ) );
Tested up to: 3.9.2
Stable tag: 1.0.1
= V1.0.1 - 08.08.2014 =
* Bugfix : Security Exploit was fixed.

= V1.0.1 =
Security Exploit was fixed.

Login/registration form bugs were fixed. Session bugs were fixed.