hitoshura25/cvefixes huggingface dataset:
CVE-2018-1000658 (PHP, published 2018-09-06T17:29Z)
Description: value: LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/helpers/common_helper.php
application/third_party/pclzip/pclzip.lib.php
Commit message: [security] Fixed issue #13960: vulnerabilities in file upload functionality



Vulnerable code:
    $p_entry['filename'] = get_absolute_path($p_entry['filename']);    

Fixed code:

/**
 * Test if a given zip file is Zip Bomb
 * see comment here : http://php.net/manual/en/function.zip-entry-filesize.php
 * @param string $zip_filename
 * @return int
 */
function isZipBomb($zip_filename)
{
    return ( get_zip_originalsize($zip_filename) >  getMaximumFileUploadSize() );
}

/**
 * Get the original size of a zip archive to prevent Zip Bombing
 * see comment here : http://php.net/manual/en/function.zip-entry-filesize.php
 * @param string $filename
 * @return int
 */
function get_zip_originalsize($filename) {

    if ( function_exists ('zip_entry_filesize') ){
        $size = 0;
        $resource = zip_open($filename);
        while ($dir_resource = zip_read($resource)) {
            $size += zip_entry_filesize($dir_resource);
        }
        zip_close($resource);

        return $size;
    }else{
        if ( YII_DEBUG ){
            Yii::app()->setFlashMessage(gT("Warning! php zip extension is not installed on your server. You're not protected from Zip Bomb attaacks."), 'error');
        }
    }

    return -1;
}

    // Added by LS Team to prevent Zip Bombing
    if (isZipBomb($p_zipname)){
        die('Abort '.basename(__FILE__).' : Unzipped file is superior to upload_max_filesize or to post_max_size');
    }


    $p_entry['filename'] = get_absolute_path($p_entry['filename']);
CVE-2018-1000659 (PHP, published 2018-09-06T17:29Z)
Description: value: LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/third_party/pclzip/pclzip.lib.php
Commit message: [security] fixed issue #13959: RCE via resource file upload as authenticated user



Vulnerable code:

Fixed code:
    // Added by LS Team to check for invalid paths
    $p_entry['filename'] = get_absolute_path($p_entry['filename']);
CVE-2019-14512 (PHP, published 2020-03-16T15:15Z)
Description: value: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/views/admin/labels/labelview_view.php
Commit message: Fixed issue [security]: #15094 XSS in label title
Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/
Dev: encode label name


Vulnerable code:
            - <?=$model->label_name;?>

Fixed code:
            - <?php echo CHtml::encode($model->label_name); ?>
CVE-2019-14512 (PHP, published 2020-03-16T15:15Z)
Description: value: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/extensions/PanelBoxWidget/views/box.php
Commit message: Fixed issue [security]: #15094 XSS in Boxes (thanks to Michele Cisternino)
Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/
Dev: encode always encode …


Vulnerable code:
    <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?=str_replace(' ', '_', strtolower($title))?>"
        data-url="<?php echo $url; ?>"

Fixed code:
    <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?php echo CHtml::encode(str_replace(' ', '_', strtolower(strip_tags($title)))) ?>"
        data-url="<?php echo CHtml::encode($url); ?>"
CVE-2019-16172 (PHP, published 2019-09-09T19:15Z)
Description: value: LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/SurveysGroupsController.php
Commit message: Fixed issue: [security] #15204: Stored XSS vulnerabilities - Thanks to J. Greil from the SEC Consult Vulnerability Lab (https://www.sec-consult.com)
Dev: encode group name in alert deleted


Vulnerable code:
                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), $sGroupTitle), 'success');

Fixed code:
                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), CHtml::encode($sGroupTitle)), 'success');
CVE-2019-16173 (PHP, published 2019-09-09T19:15Z)
Description: value: LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/core/Survey_Common_Action.php
Commit message: Fixed issue: [security] #15204: Reflected XSS vulnerabilities - thanks to J. Greil from  the  SEC  Consult Vulnerability Lab
Dev: disable pseudo params for same param to be different : throw a 403


Vulnerable code:
            /* Unsure we set 'iSurveyId', 'iSurveyID','surveyid' to same final survey id */
            /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set sid surveyid to 1 */
        // (only if that place is empty)


Fixed code:
            /* priority is surveyid,surveyId,sid : surveyId=1&sid=2 set iSurveyId to 1 */
        // Chek is 2 params are equal for security issue.
                    } elseif($params[$pseud] != $params[$key]){
                        // Throw error about multiple params (and if they are different) #15204
                        throw new CHttpException(403, sprintf(gT("Invalid parameter %s (%s already set)"),$pseud,$key));
CVE-2019-9960 (PHP, published 2019-03-24T01:29Z)
Description: value: The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/export.php
Commit message: [security] Fixed issue #14617: relative path allowed in lsa multiple download 



Vulnerable code:

Fixed code:
        $sZip         = get_absolute_path($sZip);
CVE-2020-11455 (PHP, published 2020-04-01T16:15Z)
Description: value: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/LimeSurveyFileManager.php
Commit message: Fixed issue [security] #16018: Path Traversal Vulnerability (Matthew Aberegg, Michael Burkey)


Vulnerable code:
        if($urlFormat == 'path') {
            $getFileLink .= '?path='.$zipfile;
        } else {
            $getFileLink .= '&path='.$zipfile;
        }
    public function getZipFile($path) {
        // echo "<pre>";
        // echo $path."\n";
        // echo $filename."\n";
        // echo "isFile => ".is_file($path) ? 'isFile' : 'isNoFile'."\n";
        // echo "</pre>";
        if (is_file($path) || true) {

Fixed code:
        $_SESSION['__path'] = $zipfile;
    /**
     * @return void
     */
    public function getZipFile()
    {
        $path = $_SESSION['__path'];
        unset($_SESSION['__path']);
        if (is_file($path)) {
CVE-2020-11456 (PHP, published 2020-04-01T16:15Z)
Description: value: LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/models/SurveysGroups.php
application/views/admin/surveysgroups/surveySettings.php
Commit message: Fixed issue [security] #16019: Stored XSS in survey groups. (Thanks to Matthew Aberegg and Michael Burkey)
Dev: admin view to be fixed
Dev: not shown in public : no need XSS filtering


Vulnerable code:
            array('title, name, description', 'LSYii_Validators'),
    <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.$model->title.'</strong></em>'; ?></h3>

Fixed code:
    <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
CVE-2020-22607 (PHP, published 2021-06-28T19:15Z)
Description: value: Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/PermissiontemplatesController.php
Commit message: Fixed issue [security] #16068: Stored Cross Site Scripting Vulnerability in permission rules. (Thanks to Matthew Aberegg)


Vulnerable code:

Fixed code:
        // XSS filter
        $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);
        $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);
CVE-2020-25797 (PHP, published 2020-12-31T18:15Z)
Description: value: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/views/admin/token/tokenform.php
Commit message: Fixed issue #15680: LimeSurvey 3.21.1 Cross Site Scripting Stored


Vulnerable code:
                <input class='form-control' type='text' size='30' id='firstname' name='firstname' value="<?php if (isset($firstname)) {echo $firstname; } ?>" />
                <input class='form-control' type='text' size='30' id='lastname' name='lastname' value="<?php if (isset($lastname)) {echo $lastname; } ?>" />
                <input class='form-control' type='text' maxlength='320' size='50' id='email' name='email' value="<?php if (isset($email)) {echo $email; } ?>" />
                <input class='form-control' type='text' maxlength='320' size='50' id='emailstatus' name='emailstatus' placeholder='OK' value="<?php if (isset($emailstatus)) {echo $emailstatus; } else {echo " OK "; }?>" />

Fixed code:
                    <?=TbHtml::textField('firstname', $firstname, [
                        'class' => 'form-control',
                        'size' => '30',
                    ]);?>
                    <?=TbHtml::textField('lastname', $lastname, [
                        'class' => 'form-control',
                        'size' => '30',
                    ]);?>
                <?=TbHtml::emailField('email', $email, [
                        'class' => 'form-control',
                        'size' => '50',
                        'maxlength' => '320' 
                ]);?>
                <?=TbHtml::textField('emailstatus', $emailstatus, [
                        'class' => 'form-control',
                        'size' => '50',
                        'maxlength' => '320',
                        'placeholder' => 'OK'
                ]);?>
CVE-2020-25798 (PHP, published 2020-11-17T15:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/views/admin/participants/modal_subviews/_editAttribute.php
Commit message: Fixed issue #15672: LimeSurvey 3.21.1 Cross Site Scripting


Vulnerable code:
                    echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";

Fixed code:
                    echo TbHtml::textField('ParticipantAttributeNamesDropdown[]', $attribute_value['value'], [
                        'class' => 'form-control',
                        'id' => ''
                    ]);
                    // echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";
CVE-2021-42112 (JavaScript, published 2021-10-08T21:15Z)
Description: value: The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
assets/scripts/modaldialog.js
assets/scripts/uploader.js
Commit message: Fixed issue #17562: XSS injection in the 'File upload' question type in LimeSurvey version 3.x-LTS (#2044)



Vulnerable code:
        jsonobj = eval('(' + jsonstring + ')');
        var json = eval('(' + jsontext + ')');

Fixed code:
        var jsonobj = '';
        try{
            jsonobj = JSON.parse(jsonstring);
        } catch(e) {}
        var json = '';
        try{
            json = JSON.parse(jsontext);
        } catch(e) {}
CVE-2022-29710 (PHP, published 2022-05-25T01:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/views/admin/pluginmanager/uploadConfirm.php
Commit message: Fixed issue: [security] Minor XSS issue in plugin overview - reported by Podalirius (podalirius.net/en/)


Vulnerable code:
    <?php if (isset($config)): ?>

            <?php if ($isUpdate): ?>
            <?php else: ?>
                <div class="col-sm-4"><?php echo $config->getName(); ?></div>
                <div class="col-sm-8"><?php echo $config->getDescription(); ?></div>
                <div class="col-sm-4"><?php echo $config->getVersion(); ?></div>
                <div class="col-sm-4"><?php echo $config->getAuthor(); ?></div>
                <?php if ($config->isCompatible()): ?>
                <?php else: ?>
                    <?php if ($isUpdate): ?>
                    <?php else: ?>
    <?php else: ?>


Fixed code:
    <?php if (isset($config)) : ?>
            <?php if ($isUpdate) : ?>
            <?php else : ?>
                <div class="col-sm-4"><?=htmlentities($config->getName()); ?></div>
                <div class="col-sm-8"><?=htmlentities($config->getDescription()); ?></div>
                <div class="col-sm-4"><?=htmlentities($config->getVersion()); ?></div>
                <div class="col-sm-4"><?=htmlentities($config->getAuthor()); ?></div>
                <?php if ($config->isCompatible()) : ?>
                <?php else : ?>
                    <?php if ($isUpdate) : ?>
                    <?php else : ?>
    <?php else : ?>
CVE-2022-43279 (PHP, published 2022-11-15T21:15Z)
Description: value: LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/SurveysGroupsController.php
application/views/admin/surveysgroups/update.php
Commit message: Fixed issue: Page Header and TopBar: Surveys - Survey Groups - Edit Survey Group
- Added TypeHints.
- Added green bar
- Added top bar
- Added shadow under top bar
- Renamed 'Close' to 'Back' Button


Vulnerable code:
    public function update($id)
        $oSurveySearch = new Survey('search');
        $oSurveySearch->gsid = $model->gsid;
    <h3><?php eT('Update survey group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
    <?php $this->renderPartial('super/fullpagebar_view', array(
            'fullpagebar' => array(
                'returnbutton'=>array(
                    'url'=>'surveyAdministration/listsurveys#surveygroups',
                    'text'=>gT('Close'),
                ),
                'savebutton' => array(
                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
                ),
                'saveandclosebutton' => array(
                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
                )
            )
        )); ?>


Fixed code:
     * @throws CHttpException
    public function update(int $id)
        $oSurveySearch = new Survey('search');
        $oSurveySearch->gsid = $model->gsid;

            'pageTitle' => 'Update survey group: ' . $model->title,

        $updateRightsForm = $aData['aRigths']['update'] ? 'surveys-groups-form' : null;

        $aData['fullpagebar'] = [
            'returnbutton' => [
                'url' => 'surveyAdministration/listsurveys#surveygroups',
                'text' => gT('Back'),
            ],
            'savebutton' => [
                'form' => $updateRightsForm,
            ],
            'saveandclosebutton' => [
                '$updateRightsForm',
            ],
        ];