CVE-2022-1345 (PHP, published 2022-04-13T19:15Z)
Description: value: Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
Severity: LOW (CVSS v3 base score: 9)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/causefx/organizr
Files changed:
api/classes/organizr.class.php
api/functions/log-functions.php
api/functions/organizr-functions.php
api/plugins/bookmark/plugin.php
Commit message: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


Vulnerable code:
			$targetFile = $targetPath . $_FILES['file']['name'];
			$array['name'] = htmlspecialchars($array['name']);
			$array['name'] = htmlspecialchars($array['name']);
				$username = htmlspecialchars($username);
				case 'svg':

Fixed code:
			$targetFile = $targetPath . $this->sanitizeUserString($_FILES['file']['name']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['category'] = $this->sanitizeUserString($array['category']);
			return false;
		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['category'] = $this->sanitizeUserString($array['category']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
	public function validateEmail($email)
	{
		return filter_var(trim($email), FILTER_VALIDATE_EMAIL);
	}

	public function sanitizeEmail($email)
	{
		return filter_var(trim($email), FILTER_SANITIZE_EMAIL);
	}

	public function sanitizeUserString($string)
	{
		return htmlspecialchars(trim($string));
	}

			$array['username'] = $this->sanitizeUserString($array['username']);
			if ($this->validateEmail($array['email'])) {
				$array['email'] = $this->sanitizeEmail($array['email']);
			} else {
				$this->setResponse(409, 'Email is not a valid email', ['email' => $array['email']]);
				return false;
			}
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
		if ($username == '') {
			$this->setResponse(409, 'Username was set but empty');
			return false;
		} else {
			$username = $this->sanitizeUserString($username);
		}
		if (!$email) {
			$this->setAPIResponse('error', 'Email was set not supplied', 409);
			return false;
		}
		if ($email == '') {
			$this->setAPIResponse('error', 'Email was set but empty', 409);
			return false;
		}
		if ($this->validateEmail($email)) {
			$email = $this->sanitizeEmail($email);
		} else {
			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
			return false;
		}
		$username = $this->sanitizeUserString($username);
		if ($email == '') {
			$this->setAPIResponse('error', 'Email was set but empty', 409);
			return false;
		}
		if ($this->validateEmail($email)) {
			$email = $this->sanitizeEmail($email);
		} else {
			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
			return false;
		}
			$array['group'] = $this->sanitizeUserString($array['group']);
			$array['group'] = $this->sanitizeUserString($array['group']);
				$username = $this->sanitizeUserString($username);
			$array['name'] = $this->sanitizeUserString($array['name']);
		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['background_color'] = $this->sanitizeUserString($array['background_color']);
			$array['text_color'] = $this->sanitizeUserString($array['text_color']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['background_color'] = $this->sanitizeUserString($array['background_color']);
			$array['text_color'] = $this->sanitizeUserString($array['text_color']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
			$array['category'] = $this->sanitizeUserString($array['category']);
			$array['category'] = $this->sanitizeUserString($array['category']);