CVE-2012-10004 (PHP, published 2023-01-11T07:15Z)
Description: value: A vulnerability was found in backdrop-contrib Basic Cart on Drupal. It has been classified as problematic. Affected is the function basic_cart_checkout_form_submit of the file basic_cart.cart.inc. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.x-1.1.1 is able to address this issue. The patch is identified as a10424ccd4b3b4b433cf33b73c1ad608b11890b4. It is recommended to upgrade the affected component. VDB-217950 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/backdrop-contrib/basic_cart
Files changed:
basic_cart.admin.inc
basic_cart.cart.inc
basic_cart_cart_render.tpl.php
basic_cart_cart_render_block.tpl.php
Commit message: XSS issue, drupal mail instead of mail system


Vulnerable code:
  $form['content_type']['types'] = array(
  $form['messages']['admin_subject'] = array(
  $form['messages']['admin_message'] = array(
  $form['messages']['send_user_message'] = array(
  $form['messages']['user_subject'] = array(
  $form['messages']['user_message'] = array(
  $form['thank_you']['thank_you_title'] = array(
  $form['thank_you']['thank_you_message'] = array(
  $form['save'] = array(
    '#type' => 'submit',
    '#value' => t('Save configuration'),
  );

  return $form;
}


/**
 * Callback for the admin configuration page submit function
 */
function basic_cart_admin_content_type_submit($form_id, $form_state) {
  $types = $form_state['values']['types'];
  $selected_types = array();
  foreach ($types as $type) {
    if (!empty($type)) {
      $selected_types[] = $type;
    }
  }

  // Content types.
  variable_set('basic_cart_content_types', $selected_types);

  // Admin message.
  variable_set('basic_cart_admin_message', $form_state['values']['admin_message']);
  variable_set('basic_cart_admin_subject', $form_state['values']['admin_subject']);

  // User message.
  variable_set('basic_cart_send_user_message', $form_state['values']['send_user_message']);
  variable_set('basic_cart_user_message', $form_state['values']['user_message']);
  variable_set('basic_cart_user_subject', $form_state['values']['user_subject']);

  // Thank you message.
  variable_set('basic_cart_thank_you_title', $form_state['values']['thank_you_title']);
  variable_set('basic_cart_thank_you_message', $form_state['values']['thank_you_message']);

  // Message.
  drupal_set_message(t('The configuration options have been saved.'));
  $my_module = 'basic_cart';
  $my_mail_token = 'checkout';
  $from = variable_get('site_mail');

  $message = array(
    'id' => $my_module . '_' . $my_mail_token,
    'to' => $from,
    'subject' => variable_get('basic_cart_admin_subject'),
    'body' => $message_html,
    'headers' => array(
      'From' => $from,
      'Sender' => $from,
      'Return-Path' => $from,
    ),
  );
  $system = drupal_mail_system($my_module, $my_mail_token);
  if ($system->mail($message)) {
    $message = array(
      'id' => $my_module . '_' . $my_mail_token,
      'to' => $form_state['values']['basic_cart_checkout_email'],
      'subject' => variable_get('basic_cart_user_subject'),
      'body' => $message_html,
      'headers' => array(
        'From' => $from,
        'Sender' => $from,
        'Return-Path' => $from,
      ),
    );
    $system = drupal_mail_system($my_module, $my_mail_token);
    if ($system->mail($message)) {
  return nl2br($message);
                <?php print l('<img src="' . $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif" border="0" />', 'cart/remove/' . $nid, array('html' => TRUE)); ?>

Fixed code:
  $form['content_type']['basic_cart_content_types'] = array(
  $form['messages']['basic_cart_admin_subject'] = array(
  $form['messages']['basic_cart_admin_message'] = array(
  $form['messages']['basic_cart_send_user_message'] = array(
  $form['messages']['basic_cart_user_subject'] = array(
  $form['messages']['basic_cart_user_message'] = array(
  $form['thank_you']['basic_cart_thank_you_title'] = array(
  $form['thank_you']['basic_cart_thank_you_message'] = array(
  return system_settings_form($form);
  $params['admin_message'] = filter_xss($message_html);

  $site_mail = variable_get('site_mail');
  $message = drupal_mail('basic_cart', 'admin_mail', $site_mail, language_default(), $params);

  if ($message['result']) {
  
    $params['user_message'] = filter_xss($message_html);
    // Sending mail.
    $message = drupal_mail('basic_cart', 'user_mail', $form_state['values']['basic_cart_checkout_email'], language_default(), $params);

    if ($message['result']) {

/**
 * Implements hook_mail().
 */
function basic_cart_mail($key, &$message, $params) {
  switch($key) {
    case 'admin_mail':
      $message['subject'] = check_plain(variable_get('basic_cart_admin_subject'));
      $message['body'][] = $params['admin_message'];
      break;

    case 'user_mail':
      $message['subject'] = check_plain(variable_get('basic_cart_user_subject'));
      $message['body'][] = $params['user_message'];
      break;
  }
}

  return nl2br(filter_xss($message));

                <?php 
                $variables = array(
                  'path' => $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif',
                  'alt' => t('Remove from cart'),
                  'title' => t('Remove from cart'),
                  'attributes' => array('class' => 'basic-cart-delete-image-image'),
                );
                print l(theme('image', $variables), 'cart/remove/' . $nid, array('html' => TRUE));
                ?>