CVE-2012-10002 (PHP, published 2023-01-03T09:15Z)
Description: value: A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be launched remotely. The patch is named 45a0f33876d58cb7e4a0f17da149e58fc893b858. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ahmyi/rivettracker
Files changed:
css.php
edit_database.php
sanity.php
sanity_no_output.php
statistics.php
Commit message: More security fixes:

css.php
  Unfiltered $_POSTs everywhere!
  Prevent XSS in Create CSS form entry [http://forums.rivetcode.com/viewtopic.php?f=9&t=342&p=1144#p1144]
  Typo in create css file error message.
  Needed to connect to database for cleaning function.

edit_database.php
  One line changed: a simple htmlentities() will take care of this for now.

sanity.php, sanity_no_output.php
  Changed obsolete code, no escape on queries.

statistics.php
  Filtered yet another global array


Vulnerable code:
	if (copy("./css/" . $_POST["set_css"], "./css/style.css"))
		echo "<p class=\"success\">style.css file has been replaced with " . $_POST["set_css"] . "</p>";
	if (unlink("./css/" . $_POST["delete_css"]))
		echo "<p class=\"success\">" . $_POST["delete_css"] . " has been deleted</p>";
		echo errorMessage() . "Error: Unable to delete " . $_POST["delete_css"] . ", are you sure the permissions are correct?</p>";
		if (!file_exists("./css/" . $_POST["create_css"]))
			if (copy("./css/style.css", "./css/" . $_POST["create_css"]))
				echo "<p class=\"success\">" . $_POST["create_css"] . ", was created successfuly</p>";
				echo errorMessage() . "Error: Unabled to create " . $_POST["create_css"] . ", are you sure the permissions are correct?</p>";
			echo errorMessage() . "Error: " . $_POST["create_css"] . " already exists, please choose a different name</p>";
		$filename = $_POST["create_css"];
		$filename = $_POST["edit_css"];
	if (is_writable("./css/" . $_POST["hidden_filename"]))
		$stream = fopen("./css/" . $_POST["hidden_filename"], "w");
		fwrite($stream, $_POST["file_contents"]);
		echo "<p class=\"success\">" . $_POST["hidden_filename"] . ", was saved successfuly</p>";
		if (copy("./css/" . $_POST["hidden_filename"], "./css/style.css"))
			echo "<p class=\"success\">style.css file has been replaced with " . $_POST["hidden_filename"] . "</p>";
	$filename = $_GET['filename'];
			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash=\"$hash\"");
		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash=\"$hash\"");
			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
 	$peers = loadLostPeers($hash, $timeout);
?>
Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . $_POST["filename_search"] . "\"";?>>

Fixed code:

// Prep database, needed for cleaning function
if ($GLOBALS["persist"])
	$db = @mysql_pconnect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
else
	$db = @mysql_connect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
@mysql_select_db($database) or showError("Can't open database. Contact the webmaster");

	if (copy("./css/" . filterData($_POST["set_css"]), "./css/style.css"))
		echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["set_css"]) . "</p>";
	if (unlink("./css/" . filterData($_POST["delete_css"])))
		echo "<p class=\"success\">" . filterData($_POST["delete_css"]) . " has been deleted</p>";
		echo errorMessage() . "Error: Unable to delete " . filterData($_POST["delete_css"]) . ", are you sure the permissions are correct?</p>";
		if (!file_exists("./css/" . filterData($_POST["create_css"])))
			if (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . ", was created successfuly</p>";
				echo errorMessage() . "Error: Unable to create " . filterData($_POST["create_css"]) . ", are you sure the permissions are correct?</p>";
			echo errorMessage() . "Error: " . filterData($_POST["create_css"]) . " already exists, please choose a different name</p>";
		$filename = filterData($_POST["create_css"]);
		$filename = filterData($_POST["edit_css"]);
	if (is_writable("./css/" . filterData($_POST["hidden_filename"])))
		$stream = fopen("./css/" . filterData($_POST["hidden_filename"]), "w");
		fwrite($stream, filterData($_POST["file_contents"]));
		echo "<p class=\"success\">" . filterData($_POST["hidden_filename"]) . ", was saved successfuly</p>";
		if (copy("./css/" . filterData($_POST["hidden_filename"]), "./css/style.css"))
			echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["hidden_filename"]) . "</p>";
	$filename = htmlentities($_GET['filename']);
			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash='$hash'");
		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash='$hash'");
			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
	$peers = loadLostPeers($hash, $timeout);
?>
Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . filterData($_POST["filename_search"]) . "\"";?>>