CVE-2012-10014 (Other, published 2023-04-24T18:15Z)
Description: value: A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/kau-boys-backend-localization
Files changed:
backend_localization.php
readme.txt
Commit message: Adding version 2.0: Fixing shown language in the switching message. Use htmlspecialchars() to prevent XSS vulnerabilities. Thanks again to Matt Fuller for teaching me how to do it correctly!

git-svn-id: https://plugins.svn.wordpress.org/kau-boys-backend-localization/trunk@579938 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 2.0
			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$locale_value], admin_url() )
	
	// set default if values haven't been recieved from the database
	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
		setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
			? backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] )
	setcookie( 'kau-boys_backend_localization_language', backend_localization_filter_var( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
}

function backend_localization_filter_var($lang){
	return preg_replace('/\W/', '', $lang);

Fixed code:
Version: 2.1
	// set default if values haven't been recieved from the database
	if( empty( $backend_locale ) ) $backend_locale = 'en_US';
	
			. sprintf( __( 'Switching language to %1$s... If the Dashboard isn\'t loading, use this <a href="%2$s" title="Dashboard">link</a>.', 'backend-localization' ), $wp_locale_all[$backend_locale], admin_url() )
		setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
			? htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] )
	setcookie( 'kau-boys_backend_localization_language', htmlspecialchars( $_REQUEST['kau-boys_backend_localization_language'] ), time()+60*60*24*30, '/' );
* **2.0.1** Fixing shown language in the switching message. Use htmlspecialchars() to prevent XSS vulnerabilities. Thanks again to Matt Fuller for teaching me how to do it correctly!