CVE-2015-3935 (PHP, published 2015-06-10T14:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/GPCsolutions/dolibarr
Files changed:
htdocs/adherents/liste.php
htdocs/contact/list.php
htdocs/contrat/liste.php
htdocs/product/liste.php
htdocs/societe/societe.php
Commit message: Properly escape untrusted data to prevent HTML injection.

First pass for #2857


Vulnerable code:
 * Copyright (C) 2013      Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
if ($search_categ > 0)   $sql.= " AND cm.fk_categorie = ".$search_categ;
            if (is_numeric($sall)) $sql.= "d.rowid = ".$sall." OR ";
            $sql.=" d.firstname LIKE '%".$sall."%' OR d.lastname LIKE '%".$sall."%' OR d.societe LIKE '%".$sall."%'";
            $sql.=" OR d.email LIKE '%".$sall."%' OR d.login LIKE '%".$sall."%' OR d.address LIKE '%".$sall."%'";
            $sql.=" OR d.town LIKE '%".$sall."%' OR d.note LIKE '%".$sall."%')";
	$sql.=" AND t.rowid=".$type;
	if ($statut != "") $param.="&statut=".$statut;
	if ($search_nom)   $param.="&search_nom=".$search_nom;
	if ($search_login) $param.="&search_login=".$search_login;
	if ($search_email) $param.="&search_email=".$search_email;
	if ($filter)       $param.="&filter=".$filter;
	if ($type > 0)     $param.="&type=".$type;
		print $langs->trans("Filter")." (".$langs->trans("Ref").", ".$langs->trans("Lastname").", ".$langs->trans("Firstname").", ".$langs->trans("EMail").", ".$langs->trans("Address")." ".$langs->trans("or")." ".$langs->trans("Town")."): ".$sall;
	print '<input class="flat" type="text" name="search_ref" value="'.$search_ref.'" size="4"></td>';
	print '<input class="flat" type="text" name="search_lastname" value="'.$search_lastname.'" size="12"></td>';
	print '<input class="flat" type="text" name="search_login" value="'.$search_login.'" size="7"></td>';
	print '<input class="flat" type="text" name="search_email" value="'.$search_email.'" size="12"></td>';
 * Copyright (C) 2013      Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
if ($search_categ > 0)   $sql.= " AND cs.fk_categorie = ".$search_categ;
    $param ='&begin='.urlencode($begin).'&view='.urlencode($view).'&userid='.urlencode($userid).'&contactname='.urlencode($sall);
    $param.='&type='.urlencode($type).'&view='.urlencode($view).'&search_lastname='.urlencode($search_lastname).'&search_firstname='.urlencode($search_firstname).'&search_societe='.urlencode($search_societe).'&search_email='.urlencode($search_email);
    if (!empty($search_categ)) $param.='&search_categ='.$search_categ;
    if ($search_status != '') $param.='&amp;search_status='.$search_status;
    if ($search_priv == '0' || $search_priv == '1') $param.="&search_priv=".urlencode($search_priv);
    print '<input type="hidden" name="view" value="'.$view.'">';
        print $langs->trans("Filter")." (".$langs->trans("Lastname").", ".$langs->trans("Firstname")." ".$langs->trans("or")." ".$langs->trans("EMail")."): ".$sall;
    print '<input class="flat" type="text" name="search_lastname" size="9" value="'.$search_lastname.'">';
    print '<input class="flat" type="text" name="search_firstname" size="9" value="'.$search_firstname.'">';
    print '<input class="flat" type="text" name="search_poste" size="9" value="'.$search_poste.'">';
        print '<input class="flat" type="text" name="search_societe" size="9" value="'.$search_societe.'">';
    print '<input class="flat" type="text" name="search_phonepro" size="8" value="'.$search_phonepro.'">';
    print '<input class="flat" type="text" name="search_phonemob" size="8" value="'.$search_phonemob.'">';
    print '<input class="flat" type="text" name="search_fax" size="8" value="'.$search_fax.'">';
    print '<input class="flat" type="text" name="search_email" size="8" value="'.$search_email.'">';
        print '<input class="flat" type="text" name="search_skype" size="8" value="'.$search_skype.'">';
if ($socid) $sql.= " AND s.rowid = ".$socid;
    print_barre_liste($langs->trans("ListOfContracts"), $page, $_SERVER["PHP_SELF"], '&search_contract='.$search_contract.'&search_nom='.$search_nom, $sortfield, $sortorder,'',$num);
    $param='&amp;search_contract='.$search_contract;
    $param.='&amp;search_nom='.$search_nom;
    print '<input type="text" class="flat" size="3" name="search_contract" value="'.$search_contract.'">';
    print '<input type="text" class="flat" size="24" name="search_nom" value="'.$search_nom.'">';
 * Copyright (C) 2013      Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
    if ($search_categ > 0)   $sql.= " AND cp.fk_categorie = ".$search_categ;
    	$param="&amp;sref=".$sref.($sbarcode?"&amp;sbarcode=".$sbarcode:"")."&amp;snom=".$snom."&amp;sall=".$sall."&amp;tosell=".$tosell."&amp;tobuy=".$tobuy;
    	$param.=($search_categ?"&amp;search_categ=".$search_categ:"");
    		print '<input class="flat" type="text" name="sref" size="8" value="'.$sref.'">';
    		print '<input class="flat" type="text" name="snom" size="12" value="'.$snom.'">';
    			print '<input class="flat" type="text" name="sbarcode" size="6" value="'.$sbarcode.'">';
    		$param="&amp;sref=".$sref.($sbarcode?"&amp;sbarcode=".$sbarcode:"")."&amp;snom=".$snom."&amp;sall=".$sall."&amp;tosell=".$tosell."&amp;tobuy=".$tobuy;
    		$param.=($search_categ?"&amp;search_categ=".$search_categ:"");
 * Copyright (C) 2013      Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
    $sql .= " AND sc.fk_user = ".$search_sale;
    $sql .= " AND cs.fk_categorie = ".$search_categ;
	$params = "&amp;socname=".$socname."&amp;search_nom=".$search_nom."&amp;search_town=".$search_town;
	$params.= ($sbarcode?"&amp;sbarcode=".$sbarcode:"");
	$params.= '&amp;search_idprof1='.$search_idprof1;
	$params.= '&amp;search_idprof2='.$search_idprof2;
	$params.= '&amp;search_idprof3='.$search_idprof3;
	$params.= '&amp;search_idprof4='.$search_idprof4;
	print '<input class="flat" type="text" name="search_nom" value="'.$search_nom.'">';
    	print '<td class="liste_titre">';
    	print '<input class="flat" type="text" name="sbarcode" size="6" value="'.$sbarcode.'">';
    	print '</td>';
	print '<input class="flat" size="10" type="text" name="search_town" value="'.$search_town.'">';
	print '<input class="flat" size="4" type="text" name="search_idprof1" value="'.$search_idprof1.'">';
	print '<input class="flat" size="4" type="text" name="search_idprof2" value="'.$search_idprof2.'">';
	print '<input class="flat" size="4" type="text" name="search_idprof3" value="'.$search_idprof3.'">';
	print '<input class="flat" size="4" type="text" name="search_idprof4" value="'.$search_idprof4.'">';

Fixed code:
 * Copyright (C) 2013-2015 Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
if ($search_categ > 0)   $sql.= " AND cm.fk_categorie = ".$db->escape($search_categ);
            if (is_numeric($sall)) $sql.= "d.rowid = ".$db->escape($sall)." OR ";
            $sql.=" d.firstname LIKE '%".$db->escape($sall)."%' OR d.lastname LIKE '%".$db->escape($sall)."%' OR d.societe LIKE '%".$db->escape($sall)."%'";
            $sql.=" OR d.email LIKE '%".$db->escape($sall)."%' OR d.login LIKE '%".$db->escape($sall)."%' OR d.address LIKE '%".$db->escape($sall)."%'";
            $sql.=" OR d.town LIKE '%".$db->escape($sall)."%' OR d.note LIKE '%".$db->escape($sall)."%')";
	$sql.=" AND t.rowid=".$db->escape($type);
	if ($statut != "") $param.="&statut=".htmlspecialchars($statut);
	if ($search_nom)   $param.="&search_nom=".htmlspecialchars($search_nom);
	if ($search_login) $param.="&search_login=".htmlspecialchars($search_login);
	if ($search_email) $param.="&search_email=".htmlspecialchars($search_email);
	if ($filter)       $param.="&filter=".htmlspecialchars($filter);
	if ($type > 0)     $param.="&type=".htmlspecialchars($type);
		print $langs->trans("Filter")." (".$langs->trans("Ref").", ".$langs->trans("Lastname").", ".$langs->trans("Firstname").", ".$langs->trans("EMail").", ".$langs->trans("Address")." ".$langs->trans("or")." ".$langs->trans("Town")."): ".htmlspecialchars($sall);
	print '<input class="flat" type="text" name="search_ref" value="'.htmlspecialchars($search_ref).'" size="4"></td>';
	print '<input class="flat" type="text" name="search_lastname" value="'.htmlspecialchars($search_lastname).'" size="12"></td>';
	print '<input class="flat" type="text" name="search_login" value="'.htmlspecialchars($search_login).'" size="7"></td>';
	print '<input class="flat" type="text" name="search_email" value="'.htmlspecialchars($search_email).'" size="12"></td>';
 * Copyright (C) 2013-2015 Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
if ($search_categ > 0)   $sql.= " AND cs.fk_categorie = ".$db->escape($search_categ);
    $param ='&begin='.htmlspecialchars($begin).'&view='.htmlspecialchars($view).'&userid='.htmlspecialchars($userid).'&contactname='.htmlspecialchars($sall);
    $param.='&type='.htmlspecialchars($type).'&view='.htmlspecialchars($view).'&search_lastname='.htmlspecialchars($search_lastname).'&search_firstname='.htmlspecialchars($search_firstname).'&search_societe='.htmlspecialchars($search_societe).'&search_email='.htmlspecialchars($search_email);
    if (!empty($search_categ)) $param.='&search_categ='.htmlspecialchars($search_categ);
    if ($search_status != '') $param.='&amp;search_status='.htmlspecialchars($search_status);
    if ($search_priv == '0' || $search_priv == '1') $param.="&search_priv=".htmlspecialchars($search_priv);
    print '<input type="hidden" name="view" value="'.htmlspecialchars($view).'">';
        print $langs->trans("Filter")." (".$langs->trans("Lastname").", ".$langs->trans("Firstname")." ".$langs->trans("or")." ".$langs->trans("EMail")."): ".htmlspecialchars($sall);
    print '<input class="flat" type="text" name="search_lastname" size="9" value="'.htmlspecialchars($search_lastname).'">';
    print '<input class="flat" type="text" name="search_firstname" size="9" value="'.htmlspecialchars($search_firstname).'">';
    print '<input class="flat" type="text" name="search_poste" size="9" value="'.htmlspecialchars($search_poste).'">';
        print '<input class="flat" type="text" name="search_societe" size="9" value="'.htmlspecialchars($search_societe).'">';
    print '<input class="flat" type="text" name="search_phonepro" size="8" value="'.htmlspecialchars($search_phonepro).'">';
    print '<input class="flat" type="text" name="search_phonemob" size="8" value="'.htmlspecialchars($search_phonemob).'">';
    print '<input class="flat" type="text" name="search_fax" size="8" value="'.htmlspecialchars($search_fax).'">';
    print '<input class="flat" type="text" name="search_email" size="8" value="'.htmlspecialchars($search_email).'">';
        print '<input class="flat" type="text" name="search_skype" size="8" value="'.htmlspecialchars($search_skype).'">';
if ($socid) $sql.= " AND s.rowid = ".$db->escape($socid);
    print_barre_liste($langs->trans("ListOfContracts"), $page, $_SERVER["PHP_SELF"], '&search_contract='.htmlspecialchars($search_contract).'&search_nom='.htmlspecialchars($search_nom), $sortfield, $sortorder,'',$num);
    $param='&amp;search_contract='.htmlspecialchars($search_contract);
    $param.='&amp;search_nom='.htmlspecialchars($search_nom);
    print '<input type="text" class="flat" size="3" name="search_contract" value="'.htmlspecialchars($search_contract).'">';
    print '<input type="text" class="flat" size="24" name="search_nom" value="'.htmlspecialchars($search_nom).'">';
 * Copyright (C) 2013-2015 Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
    if ($search_categ > 0)   $sql.= " AND cp.fk_categorie = ".$db->escape($search_categ);
    	$param="&amp;sref=".htmlspecialchars($sref).($sbarcode?"&amp;sbarcode=".htmlspecialchars($sbarcode):"")."&amp;snom=".htmlspecialchars($snom)."&amp;sall=".htmlspecialchars($sall)."&amp;tosell=".htmlspecialchars($tosell)."&amp;tobuy=".htmlspecialchars($tobuy);
    	$param.=($search_categ?"&amp;search_categ=".htmlspecialchars($search_categ):"");
    		print '<input class="flat" type="text" name="sref" size="8" value="'.htmlspecialchars($sref).'">';
    		print '<input class="flat" type="text" name="snom" size="12" value="'.htmlspecialchars($snom).'">';
    			print '<input class="flat" type="text" name="sbarcode" size="6" value="'.htmlspecialchars($sbarcode).'">';
    		$param="&amp;sref=".htmlspecialchars($sref).($sbarcode?"&amp;sbarcode=".htmlspecialchars($sbarcode):"")."&amp;snom=".htmlspecialchars($snom)."&amp;sall=".htmlspecialchars($sall)."&amp;tosell=".htmlspecialchars($tosell)."&amp;tobuy=".htmlspecialchars($tobuy);
    		$param.=($search_categ?"&amp;search_categ=".htmlspecialchars($search_categ):"");
 * Copyright (C) 2013-2015 Raphaël Doursenaud   <rdoursenaud@gpcsolutions.fr>
    $sql .= " AND sc.fk_user = ".$db->escape($search_sale);
    $sql .= " AND cs.fk_categorie = ".$db->escape($search_categ);
	$params = "&amp;socname=".htmlspecialchars($socname)."&amp;search_nom=".htmlspecialchars($search_nom)."&amp;search_town=".htmlspecialchars($search_town);
	$params.= ($sbarcode?"&amp;sbarcode=".htmlspecialchars($sbarcode):"");
	$params.= '&amp;search_idprof1='.htmlspecialchars($search_idprof1);
	$params.= '&amp;search_idprof2='.htmlspecialchars($search_idprof2);
	$params.= '&amp;search_idprof3='.htmlspecialchars($search_idprof3);
	$params.= '&amp;search_idprof4='.htmlspecialchars($search_idprof4);
	print '<input class="flat" type="text" name="search_nom" value="'.htmlspecialchars($search_nom).'">';
		print '<td class="liste_titre">';
		print '<input class="flat" type="text" name="sbarcode" size="6" value="'.htmlspecialchars($sbarcode).'">';
		print '</td>';
	print '<input class="flat" size="10" type="text" name="search_town" value="'.htmlspecialchars($search_town).'">';
	print '<input class="flat" size="4" type="text" name="search_idprof1" value="'.htmlspecialchars($search_idprof1).'">';
	print '<input class="flat" size="4" type="text" name="search_idprof2" value="'.htmlspecialchars($search_idprof2).'">';
	print '<input class="flat" size="4" type="text" name="search_idprof3" value="'.htmlspecialchars($search_idprof3).'">';
	print '<input class="flat" size="4" type="text" name="search_idprof4" value="'.htmlspecialchars($search_idprof4).'">';