CVE-2015-0882 (PHP, published 2015-02-27T02:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zencart-ja/zc-v1-series
Files changed:
admin/includes/auto_loaders/config.core.php
admin/includes/init_includes/init_sanitize.php
includes/init_includes/init_sanitize.php
Commit message: JPCERT/CC 脆弱性情報ハンドリングチームより、Zen Cartにおけるクロスサイトスクリプティングの脆弱性があるとのことで、1.5.3、1.5.4からソースを持ってきて変更し、対応しました。

Signed-off-by: kimono <maeda@obitastar.co.jp>


Vulnerable code:
 * @copyright Copyright 2003-2011 Zen Cart Development Team
 * @version $Id: init_sanitize.php 18698 2011-05-04 14:50:06Z wilt $
// ** NOTE: THIS FILE CAN BE DELETED. It is no longer needed.
 * @copyright Copyright 2003-2012 Zen Cart Development Team
 * @version GIT: $Id: Author: DrByte  Thu Aug 2 11:55:32 2012 -0400 Modified in v1.5.1 $
  $_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9.%]/', '', $_SERVER['REMOTE_ADDR']);

Fixed code:
  $autoLoadConfig[20][] = array('autoType'=>'init_script',
                                'loadFile'=> 'init_sanitize.php');
 * init_sanitize
 * @copyright Copyright 2003-2014 Zen Cart Development Team
 * @version GIT: $Id: Author: Ian Wilson  Fri Mar 7 21:54:17 2014 +0000 Modified in v1.5.3 $
$saniGroup1 = array('action', 'add_products_id', 'attribute_id', 'attribute_page', 'attributes_id', 'banner', 'bID', 'box_name', 'build_cat', 'came_from', 'categories_update_id', 'cID', 'cid', 'configuration_key_lookup', 'copy_attributes',
'cpage', 'cPath', 'current_category_id', 'current', 'customer', 'debug', 'debug2', 'debug3', 'define_it', 'download_reset_off', 'download_reset_on', 'end_date', 'ezID', 'fID', 'filename', 'flag',
'flagbanners_on_ssl', 'flagbanners_open_new_windows', 'gID', 'gid', 'global', 'go_back', 'id', 'info', 'ipnID', 'keepslashes', 'layout_box_name', 'lID', 'list_order', 'language', 'lng_id', 'lngdir', 'mail_sent_to', 'manual',
'master_category', 'mID', 'mode', 'module', 'month', 'na', 'nID', 'nogrants', 'ns', 'number_of_uploads', 'oID', 'oldaction', 'option_id', 'option_order_by', 'option_page', 'options_id_from', 'options_id', 'order_by',
'order', 'origin', 'p', 'padID', 'page', 'pages_id', 'payment_status', 'paypal_ipn_sort_order', 'pID', 'ppage', 'product_type', 'products_filter_name_model', 'products_filter', 'products_id',
'products_options_id_all', 'products_update_id', 'profile', 'ptID', 'q', 'read', 'recip_count', 'referral_code', 'reports_page', 'reset_categories_products_sort_order', 'reset_editor', 'reset_ez_sort_order',
'reset_option_names_values_copier', 'rID', 's', 'saction', 'selected_box', 'set', 'set_display_categories_dropdown', 'sID', 'spage', 'start_date', 'status', 't', 'tID', 'type', 'uid', 'update_action', 'update_to', 'user',
'value_id', 'value_page', 'vcheck', 'year', 'za_lookup', 'zID', 'zone', 'zpage');
foreach ($saniGroup1 as $key)
{
  if (isset($_GET[$key]))
  {
    $_GET[$key] = preg_replace('/[^\/ 0-9a-zA-Z_:@.-]/', '', $_GET[$key]);
  }
}
 * @copyright Copyright 2003-2013 Zen Cart Development Team
 * @version GIT: $Id: Author: Ian Wilson  Thu Nov 7 15:58:09 2013 +0000 Modified in v1.5.2 $
  $saniGroup1 = array('action', 'addr', 'alpha_filter_id', 'alpha_filter', 'authcapt', 'chapter', 'cID', 'currency', 'debug', 'delete', 'dfrom', 'disp_order', 'dto', 'edit', 'faq_item', 'filter_id', 'goback', 'goto', 'gv_no', 'id', 'inc_subcat', 'language', 'markflow', 'music_genre_id', 'nocache', 'notify', 'number_of_uploads', 'order_id', 'order', 'override', 'page', 'pfrom', 'pid', 'pID', 'pos', 'product_id', 'products_image_large_additional', 'products_tax_class_id', 'pto', 'record_company_id', 'referer', 'reviews_id', 'search_in_description', 'set_session_login', 'token', 'tx', 'type', 'zenid');
  foreach ($saniGroup1 as $key)
  {
    if (isset($_GET[$key]))
    {
      $_GET[$key] = preg_replace('/[^\/0-9a-zA-Z_:@.-]/', '', $_GET[$key]);
    }
  }

  $_SERVER['REMOTE_ADDR'] = preg_replace('~[^a-fA-F0-9.:%/]~', '', $_SERVER['REMOTE_ADDR']);