CVE-2018-20322 (PHP, published 2018-12-21T23:29Z)
Description: value: LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/views/admin/survey/importSurveyResources_view.php
application/views/admin/themes/importuploaded_view.php
application/views/admin/themes/templatesummary_view.php
Commit message: [security] Fixed issue #14376: XSS in Survey Resource zip upload
[security] Fixed issue : XSS in theme zip upload
Dev: CHtml::encode filename (whole) when view
Dev: Same with import theme
Dev: some other fix to do : reporting issues


Vulnerable code:
                        foreach ($aImportedFilesInfo as $entry)
                        {
                            echo CHtml::tag('li', array(), gT("File") . ': ' . $entry["filename"]);
                            foreach ($aImportedFilesInfo as $entry)
                            {
                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry["filename"]);
                            foreach ($aErrorFilesInfo as $entry)
                            {
                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry['filename'] . " (" . $entry['status'] . ")");
                            foreach ($aErrorFilesInfo as $entry)
                            {
                                echo CHtml::tag('li', array(), gT("File") . ': ' . $entry['filename'] . " (" . $entry['status'] . ")");
                                <li><?php echo gT("Folder:") . " " . htmlspecialchars($entry["filename"],ENT_QUOTES,'utf-8'); ?></li>
                                <li><?php echo gT("File:") . " " . htmlspecialchars($entry["filename"],ENT_QUOTES,'utf-8'); ?></li>
                            <li><?php echo gT("File:") . " " . $entry["filename"] ?></li>
                            <?php echo (empty(substr(strrchr($file, DIRECTORY_SEPARATOR), 1)))?$file:substr(strrchr($file, DIRECTORY_SEPARATOR), 1) ;?>

Fixed code:
                        foreach ($aImportedFilesInfo as $entry) {
                            echo CHtml::tag('li', array(), sprintf(gT("File: %s"),CHtml::encode($entry["filename"])));
                            foreach ($aImportedFilesInfo as $entry) {
                                echo CHtml::tag('li', array(), sprintf(gT("File: %s"),CHtml::encode($entry["filename"])));
                            foreach ($aErrorFilesInfo as $entry) {
                                echo CHtml::tag('li', array(), sprintf(gT("File: %s (%s)"),CHtml::encode($entry["filename"]),$entry['status']));
                            foreach ($aErrorFilesInfo as $entry) {
                                echo CHtml::tag('li', array(), sprintf(gT("File: %s (%s)"),CHtml::encode($entry["filename"]),$entry['status']));
                                <li><?php printf(gT("Folder: %s"),CHtml::encode($entry["filename"])); ?></li>
                                <li><?php printf(gT("File: %s"),CHtml::encode($entry["filename"])); ?></li>
                            <li><?php printf(gT("File: %s"),CHtml::encode($entry["filename"])); ?></li>
                            <?php echo CHtml::encode((empty(substr(strrchr($file, DIRECTORY_SEPARATOR), 1)))?$file:substr(strrchr($file, DIRECTORY_SEPARATOR), 1)) ;?>