CVE-2023-0606 (PHP, published 2023-02-01T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ampache/ampache
Files changed:
public/templates/show_alphabet_form.inc.php
public/templates/show_form_browse.inc.php
public/templates/show_form_highest.inc.php
public/templates/show_form_mashup.inc.php
public/templates/show_form_newest.inc.php
public/templates/show_form_popular.inc.php
public/templates/show_form_recent.inc.php
public/templates/show_form_userflag.inc.php
public/templates/show_graphs.inc.php
src/Module/Application/ApplicationRunner.php
src/Module/Application/Playback/PlayAction.php
Commit message: sanitize special characters in action gets


Vulnerable code:
    <input type="hidden" name="action" value="<?php echo scrub_out(filter_input(INPUT_GET, 'action', FILTER_SANITIZE_URL)); ?>">
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES);
    <input type="hidden" name="action" value="<?php echo filter_input(INPUT_GET, 'action', FILTER_SANITIZE_URL); ?>" />
        $action_name = $request->getParsedBody()['action'] ?? $request->getQueryParams()['action'] ?? '';
                header('Location: ' . $media->play_url('', $player, false, $user->id, $user->streamtoken));
                    header('Location: ' . $media->play_url('', $player, false, $user->id, $user->streamtoken));
                header('Location: ' . $media->file);

Fixed code:
    <input type="hidden" name="action" value="<?php echo scrub_out(filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS)); ?>">
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
$filter_str      = (string) filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS);
    <input type="hidden" name="action" value="<?php echo filter_input(INPUT_GET, 'action', FILTER_SANITIZE_SPECIAL_CHARS); ?>" />
        $action_name = htmlspecialchars($request->getParsedBody()['action'] ?? $request->getQueryParams()['action'] ?? '');
                header('Location: ' . $media->play_url('', $player, false, $user->id, $user->streamtoken), true, 303);
                    header('Location: ' . $media->play_url('', $player, false, $user->id, $user->streamtoken), true, 303);
                header('Location: ' . $media->file, true, 303);