CVE-2016-10508 (PHP, published 2017-08-31T20:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/JamesHeinrich/phpThumb
Files changed:
demo/phpThumb.demo.showpic.php
Commit message: demo.showpic security fix

Sanitize input data to prevent Reflected XSS problems


Vulnerable code:
function SafeStripSlashes($string) {
	return (get_magic_quotes_gpc() ? stripslashes($string) : $string);
}
			$additionalparameters[] = $key.'[]='.SafeStripSlashes($value2);
		$additionalparameters[] = $key.'='.SafeStripSlashes($value);
//$imagesrc = $phpThumbLocation.implode('&', $additionalparameters);
$imagesrc = phpThumbURL(implode($PHPTHUMB_CONFIG['config_high_security_url_separator'], $additionalparameters), $phpThumbLocation);
echo 'var ns4;';
echo 'var op5;';
echo 'function setBrowserWindowSizeToImage() {';
echo 	'if (!document.getElementById("imageimg")) { return false; }';
echo	'sniffBrowsers();';
echo 	'var imageW = getImageWidth("imageimg");';
echo 	'var imageH = getImageHeight("imageimg");';
echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (IE, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";';
?>

</head>
<body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan"><?php
	echo 'Usage:<br><br><b>'.$_SERVER['PHP_SELF'].'?src=<i>filename</i>&title=<i>Picture+Title</i></b>';

Fixed code:
$allowedGETparameters = array('src','new','w','h','wp','hp','wl','hl','ws','hs','f','q','sx','sy','sw','sh','zc','bc','bg','bgt','fltr','xto','ra','ar','aoe','far','iar','maxb','hash','md5s','sfn','dpi','sia');
	if (!in_array($key, $allowedGETparameters)) {
		continue;
	}
		if ($key != 'fltr') {
			continue;
		}
			@$additionalparameters[$key][] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value2);
		$additionalparameters[$key] = preg_replace('#[^A-Za-z0-9\\. _:/]#', '', $value);
$imagesrc = phpThumbURL($additionalparameters, $phpThumbLocation);
echo 'var ns4;'."\n";
echo 'var op5;'."\n";
echo 'function setBrowserWindowSizeToImage() {'."\n";
echo 	'if (!document.getElementById("imageimg")) { return false; }'."\n";
echo	'sniffBrowsers();'."\n";
echo 	'var imageW = getImageWidth("imageimg");'."\n";
echo 	'var imageH = getImageHeight("imageimg");'."\n";
echo 		'document.getElementById("showpicspan").innerHTML = "<iframe width=\"100%\" height=\"100%\" marginheight=\"0\" marginwidth=\"0\" frameborder=\"0\" scrolling=\"on\" src=\"'.$imagesrc.'\">Your browser does not support the IFRAME tag. Please use one that does (Chrome, Firefox, etc).<br><img src=\"'.$imagesrc.'\"><\/iframe>";'."\n";
echo '</head><body style="margin: 0px;" onLoad="setBrowserWindowSizeToImage();"><div id="showpicspan">';
	echo 'Usage:<br><br><b>'.basename(__FILE__).'?src=<i>filename</i>&amp;title=<i>Picture+Title</i></b>';