CVE-2022-1347 (PHP, published 2022-04-13T19:15Z)
Description: value: Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation
Severity: MEDIUM (CVSS v3 base score: 8.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/causefx/organizr
Files changed:
api/classes/organizr.class.php
api/functions/log-functions.php
api/functions/organizr-functions.php
api/plugins/bookmark/plugin.php
Commit message: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


Vulnerable code:
			$targetFile = $targetPath . $_FILES['file']['name'];
			$array['name'] = htmlspecialchars($array['name']);
			$array['name'] = htmlspecialchars($array['name']);
				$username = htmlspecialchars($username);
				case 'svg':

Fixed code:
			$targetFile = $targetPath . $this->sanitizeUserString($_FILES['file']['name']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['category'] = $this->sanitizeUserString($array['category']);
			return false;
		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['category'] = $this->sanitizeUserString($array['category']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
	public function validateEmail($email)
	{
		return filter_var(trim($email), FILTER_VALIDATE_EMAIL);
	}

	public function sanitizeEmail($email)
	{
		return filter_var(trim($email), FILTER_SANITIZE_EMAIL);
	}

	public function sanitizeUserString($string)
	{
		return htmlspecialchars(trim($string));
	}

			$array['username'] = $this->sanitizeUserString($array['username']);
			if ($this->validateEmail($array['email'])) {
				$array['email'] = $this->sanitizeEmail($array['email']);
			} else {
				$this->setResponse(409, 'Email is not a valid email', ['email' => $array['email']]);
				return false;
			}
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
		if ($username == '') {
			$this->setResponse(409, 'Username was set but empty');
			return false;
		} else {
			$username = $this->sanitizeUserString($username);
		}
		if (!$email) {
			$this->setAPIResponse('error', 'Email was set not supplied', 409);
			return false;
		}
		if ($email == '') {
			$this->setAPIResponse('error', 'Email was set but empty', 409);
			return false;
		}
		if ($this->validateEmail($email)) {
			$email = $this->sanitizeEmail($email);
		} else {
			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
			return false;
		}
		$username = $this->sanitizeUserString($username);
		if ($email == '') {
			$this->setAPIResponse('error', 'Email was set but empty', 409);
			return false;
		}
		if ($this->validateEmail($email)) {
			$email = $this->sanitizeEmail($email);
		} else {
			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
			return false;
		}
			$array['group'] = $this->sanitizeUserString($array['group']);
			$array['group'] = $this->sanitizeUserString($array['group']);
				$username = $this->sanitizeUserString($username);
			$array['name'] = $this->sanitizeUserString($array['name']);
		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['background_color'] = $this->sanitizeUserString($array['background_color']);
			$array['text_color'] = $this->sanitizeUserString($array['text_color']);
			$array['name'] = $this->sanitizeUserString($array['name']);
			$array['background_color'] = $this->sanitizeUserString($array['background_color']);
			$array['text_color'] = $this->sanitizeUserString($array['text_color']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
			$array['category'] = $this->sanitizeUserString($array['category']);
			$array['category'] = $this->sanitizeUserString($array['category']);