CVE-2022-4637 (PHP, published 2022-12-21T22:15Z)
Description: value: A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is ef49e709c8adecc3a83cdc6164a67162991d2213. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tkrebs/ep3-bs
Files changed:
module/Backend/src/Backend/View/Helper/User/UserFormat.php
module/Backend/view/backend/booking/edit-choice.phtml
module/Backend/view/backend/booking/players.phtml
module/Calendar/src/Calendar/View/Helper/Cell/Render/FreeForPrivileged.php
module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForPrivileged.php
module/Calendar/src/Calendar/View/Helper/Cell/Render/OccupiedForVisitors.php
module/Frontend/view/frontend/index/userpanel.online.phtml
Commit message: Fix potential XSS vulnerability, fixes #564


Vulnerable code:
            $user->need('alias'));
}
                        <?= $this->t('from') ?> <?= $reservation->getExtra('booking')->getExtra('user')->get('alias') ?>
</div>
        $this->user->need('alias'));
                $user->need('alias'));
            return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
                    return $view->calendarCellLink($cellLabel, $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
                    return $view->calendarCellLink($cellLabel, $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
                <?= sprintf($this->t('Online as %s'), $this->user->need('alias')) ?>
</table>

Fixed code:
            $view->escapeHtml($user->need('alias')));
}
                        <?= $this->t('from') ?> <?= $this->escapeHtml($reservation->getExtra('booking')->getExtra('user')->get('alias')) ?>
</div>
        $this->escapeHtml($this->user->need('alias')));
                $this->escapeHtml($user->need('alias')));
            return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-free cc-free-partially' . $cellGroup);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('backend/booking/edit', [], $cellLinkParams), 'cc-single' . $cellGroup, null, $cellStyle);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-single' . $cellGroup);
                    return $view->calendarCellLink($view->escapeHtml($cellLabel), $view->url('square', [], $cellLinkParams), 'cc-multiple' . $cellGroup);
                <?= sprintf($this->t('Online as %s'), $this->escapeHtml($this->user->need('alias'))) ?>
</table>