CVE-2023-1881 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/helpers/helpers.php
userfiles/modules/site_stats/src/Tracker.php
Commit message: update


Vulnerable code:
    }  else if (isset($_SERVER['HTTP_CLIENT_IP'])) {
    if(app()->bound('user_manager')){
    $editModeParam2 = app()->url_manager->param('editmode',true);
    if(defined('IN_EDIT') and IN_EDIT){
 * @category users
 * @author   Microweber
 * @param bool $id
 * @return array
   // return $user->can($permission);
 //   $permissions = \MicroweberPackages\Role\Repositories\Permission::generateModulePermissionsSlugs($module);
   /* if ($user->can($permissions['destroy'])) {
        return true;
    }*/
 /*   if ($user->can($permissions['index'])) {
        return true;
    }*/

function detect_user_id_from_params($params){
                if (isset($item['language']) and $item['language']) {


Fixed code:
    $ipaddressDefault = '127.0.0.1';
    } else if (isset($_SERVER['HTTP_CLIENT_IP'])) {
    $ipv4_validation_regex = "/^(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/";
    $ipv6_validation_regex = "/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/";

    if (!preg_match($ipv4_validation_regex, $ipaddress) and !preg_match($ipv6_validation_regex, $ipaddress)) {
        //invalid ip is sent, so we return default ip
        return $ipaddressDefault;
    }


    if (app()->bound('user_manager')) {
    $editModeParam2 = app()->url_manager->param('editmode', true);
    if (defined('IN_EDIT') and IN_EDIT) {
 * @param bool $id
 * @return array
 * @category users
 * @author   Microweber
    // return $user->can($permission);
    //   $permissions = \MicroweberPackages\Role\Repositories\Permission::generateModulePermissionsSlugs($module);
    /* if ($user->can($permissions['destroy'])) {
         return true;
     }*/
    /*   if ($user->can($permissions['index'])) {
           return true;
       }*/
function detect_user_id_from_params($params)
{
                $item = array_map('strip_tags', $item);
                $item = array_map('e', $item);
                 if (isset($item['language']) and $item['language']) {
        $ref = e($ref);
            $last_page = e($last_page);