CVE-2012-10003 (PHP, published 2023-01-03T12:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ahmyi/rivettracker
Files changed:
DumpTorrentCGI.php
batch_upload.php
css.php
deleter.php
edit_database.php
editconfig.php
install.php
newtorrents.php
statistics.php
Commit message: encase $_SERVER['PHP_SELF'] with htmlentities() to prevent XSS attacks


Vulnerable code:
<form enctype="multipart/form-data" method="POST" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
		<form enctype="multipart/form-data" action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
<form action="<?php echo $_SERVER["PHP_SELF"];?>"  method="POST">
		echo "<tr><td><a href=\"" . $PHP_SELF . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
			<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
	<form enctype="multipart/form-data" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
	$scriptname = $_SERVER["PHP_SELF"] . "?";

Fixed code:
<form enctype="multipart/form-data" method="POST" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
		<form enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>"  method="POST">
		echo "<tr><td><a href=\"" . htmlentities($_SERVER['PHP_SELF']) . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
			<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
	<form enctype="multipart/form-data" method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
	$scriptname = htmlentities($_SERVER['PHP_SELF']) . "?";