CVE-2020-17476 (PHP, published 2020-08-10T17:15Z)
Description: value: Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Mibew/mibew
Files changed:
src/mibew/libs/chat.php
src/mibew/libs/classes/Mibew/Controller/ButtonController.php
src/mibew/libs/classes/Mibew/Controller/Chat/RedirectController.php
src/mibew/libs/classes/Mibew/RequestProcessor/ThreadProcessor.php
src/mibew/libs/classes/Mibew/Thread.php
src/mibew/libs/invitation.php
Commit message: Fix multiple XSS (thanks to adsec2s)


Vulnerable code:
                array($operator_name),
                getlocal('Visitor came from page {0}', array($referrer), get_current_locale(), true)
                    array(get_operator_name($requested_operator)),
            getlocal('Info: {0}', array($info), get_current_locale(), true)
                    array($referer),
                array(get_operator_name($this->getOperator())),
                array(get_operator_name($this->getOperator())),
                getlocal('E-Mail: {0}', array($email), get_current_locale(), true)
                getlocal('Visitor came from page {0}', array($referrer), get_current_locale(), true)
                getlocal('E-Mail: {0}', array($email), get_current_locale(), true)
                getlocal('Info: {0}', array($info), get_current_locale(), true)
                    array($operator_name, $this->agentName),
                    array($operator_name),
                    array($this->userName),
                        array($this->agentName),
                array($operator_name, $this->agentName),
                array($operator_name),
                array($operator_name),
                array($old_name, $new_name),
            array($operator_name, $last_visited_page),

Fixed code:
                array(safe_htmlspecialchars($operator_name)),
                getlocal('Visitor came from page {0}', array(safe_htmlspecialchars($referrer)), get_current_locale(), true)
                    array(safe_htmlspecialchars(get_operator_name($requested_operator))),
            getlocal('Info: {0}', array(safe_htmlspecialchars($info)), get_current_locale(), true)
                    array(safe_htmlspecialchars($referer)),
                array(safe_htmlspecialchars(get_operator_name($this->getOperator()))),
                array(safe_htmlspecialchars(get_operator_name($this->getOperator()))),
                getlocal('E-Mail: {0}', array(safe_htmlspecialchars($email)), get_current_locale(), true)
                getlocal('Visitor came from page {0}', array(safe_htmlspecialchars($referrer)), get_current_locale(), true)
                getlocal('E-Mail: {0}', array(safe_htmlspecialchars($email)), get_current_locale(), true)
                getlocal('Info: {0}', array(safe_htmlspecialchars($info)), get_current_locale(), true)
                    array(safe_htmlspecialchars($operator_name), safe_htmlspecialchars($this->agentName)),
                    array(safe_htmlspecialchars($operator_name)),
                    array(safe_htmlspecialchars($this->userName)),
                        array(safe_htmlspecialchars($this->agentName)),
                array(safe_htmlspecialchars($operator_name), safe_htmlspecialchars($this->agentName)),
                array(safe_htmlspecialchars($operator_name)),
                array(safe_htmlspecialchars($operator_name)),
                array(safe_htmlspecialchars($old_name), safe_htmlspecialchars($new_name)),
            array(safe_htmlspecialchars($operator_name), safe_htmlspecialchars($last_visited_page)),