CVE-2023-1367 (PHP, published 2023-03-13T09:15Z)
Description: value: Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 3.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/views/components/appointments_modal.php
application/views/components/backend_footer.php
application/views/components/google_analytics_script.php
application/views/components/matomo_analytics_script.php
application/views/emails/account_recovery_email.php
application/views/emails/appointment_deleted_email.php
application/views/emails/appointment_saved_email.php
Commit message: Apply the new escape helper function to the view files


Vulnerable code:
                                                    ? $group[0]['category_name']
                                                            . $service['name'] . '</option>';
                                                    . $service['name'] . '</option>';
                                            <option value="<?= $appointment_status_option ?>">
                                                <?= $appointment_status_option ?>
            <?= lang('hello') . ', ' . $user_display_name ?>!
        ga("create", "<?= $google_analytics_code ?>", "auto");
        gtag("config", "<?= $google_analytics_code ?>");
            var u = "<?= $matomo_analytics_url ?>";
        <p><img src="<?= $matomo_analytics_url ?>matomo.php?idsite=1&amp;rec=1" style="border:0;" alt=""/></p>
            <?= $settings['company_name'] ?>
            <?= $settings['company_name'] ?>
            <?= $settings['company_name'] ?>
                    <?= $service['name'] ?>
                    <?= $provider['first_name'] . ' ' . $provider['last_name'] ?>
                        <?= $appointment['location'] ?>
                        <?= $appointment['notes'] ?>
                    <?= $customer['first_name'] . ' ' . $customer['last_name'] ?>
                    <?= $customer['email'] ?>
                    <?= $customer['phone_number'] ?>
                    <?= $customer['address'] ?>
            <?= $reason ?>
        <a href="<?= $settings['company_link'] ?>" style="text-decoration: none;">
            <?= $settings['company_name'] ?>
            <?= $settings['company_name'] ?>
                    <?= $service['name'] ?>
                    <?= $provider['first_name'] . ' ' . $provider['last_name'] ?>
                        <?= $appointment['location'] ?>
                        <?= $appointment['notes'] ?>
                    <?= $customer['first_name'] . ' ' . $customer['last_name'] ?>
                    <?= $customer['email'] ?>
                    <?= $customer['phone_number'] ?>
                    <?= $customer['address'] ?>
        <a href="<?= $appointment_link ?>" style="width: 600px;">
            <?= $appointment_link ?>
        <a href="<?= $settings['company_link'] ?>" style="text-decoration: none;">
            <?= $settings['company_name'] ?>

Fixed code:
                                        
                                            
                                                    ? e($group[0]['category_name'])
                                                            . e($service['name']) . '</option>';
                                                    . e($service['name']) . '</option>';
                                            <option value="<?= e($appointment_status_option) ?>">
                                                <?= e($appointment_status_option) ?>
            <?= lang('hello') . ', ' . e($user_display_name) ?>!
        ga("create", "<?= e($google_analytics_code) ?>", "auto");
        gtag("config", "<?= e($google_analytics_code) ?>");
            var u = "<?= e($matomo_analytics_url) ?>";
        <p><img src="<?= e($matomo_analytics_url) ?>matomo.php?idsite=1&amp;rec=1" style="border:0;" alt=""/></p>
            <?= e($settings['company_name']) ?>
            <?= e($settings['company_name']) ?>
            <?= e($settings['company_name']) ?>
                    <?= e($service['name']) ?>
                    <?= e($provider['first_name'] . ' ' . $provider['last_name']) ?>
                        <?= e($appointment['location']) ?>
                        <?= e($appointment['notes']) ?>
                    <?= e($customer['first_name'] . ' ' . $customer['last_name']) ?>
                    <?= e($customer['email']) ?>
                    <?= e($customer['phone_number']) ?>
                    <?= e($customer['address']) ?>
            <?= e($reason) ?>
        <a href="<?= e($settings['company_link']) ?>" style="text-decoration: none;">
            <?= e($settings['company_name']) ?>
            <?= e($settings['company_name']) ?>
                    <?= e($service['name']) ?>
                    <?= e($provider['first_name'] . ' ' . $provider['last_name']) ?>
                        <?= e($appointment['location']) ?>
                        <?= e($appointment['notes']) ?>
                    <?= e($customer['first_name'] . ' ' . $customer['last_name']) ?>
                    <?= e($customer['email']) ?>
                    <?= e($customer['phone_number']) ?>
                    <?= e($customer['address']) ?>
        <a href="<?= e($appointment_link) ?>" style="width: 600px;">
            <?= e($appointment_link) ?>
        <a href="<?= e($settings['company_link']) ?>" style="text-decoration: none;">
            <?= e($settings['company_name']) ?>