CVE-2018-12043 (PHP, published 2018-06-07T20:29Z)
Description: value: content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/symphonycms/symphony-2
Files changed:
symphony/content/content.blueprintspages.php
Commit message: Fix possible self-XSS in the pages content page

Reported by Linkey <2542566937@qq.com>


Vulnerable code:
                    PageManager::fetchTitleFromHandle($page),
                    PageManager::fetchTitleFromHandle($page),
                $page = new XMLElement('span', PageManager::fetchTitleFromHandle($page));
        $this->appendSubheading(isset($parent) ? $parent['title'] : __('Pages'), Widget::Anchor(
            __('Create New'), Administration::instance()->getCurrentPageURL() . 'new/' . ($nesting && isset($parent) ? "?parent={$parent['id']}" : null),
            __('Create a new page'), 'create button', null, array('accesskey' => 'c')
        ));
                $col_title = Widget::TableData(Widget::Anchor($page_title, $page_edit_url, $page['handle']));
                $col_title->appendChild(Widget::Label(__('Select Page %s', array($page_title)), null, 'accessible', null, array(
                    'for' => 'page-' . $page['id']
                )));
                    $col_params = Widget::TableData(trim($page['params'], '/'));
                    $col_types = Widget::TableData(implode(', ', $page['type']));
        $this->setTitle(__(
            ($title ? '%1$s &ndash; %2$s &ndash; %3$s' : '%2$s &ndash; %3$s'),
            array(
                $title,
                __('Pages'),
                __('Symphony')
        ));
            $this->appendSubheading($title, array(
                Widget::Anchor(__('View Page'), $page_url, __('View Page on Frontend'), 'button', null, array('target' => '_blank', 'accesskey' => 'v'))
            ));
            $this->appendSubheading(!empty($title) ? $title : __('Untitled'));
            $tags->appendChild(new XMLElement('li', $type));
            'action[save]', ($this->_context[0] == 'edit' ? __('Save Changes') : __('Create Page')),
            'submit', array('accesskey' => 's')

Fixed code:
                    General::sanitize(PageManager::fetchTitleFromHandle($page)),
                    General::sanitize(PageManager::fetchTitleFromHandle($page)),
                $page = new XMLElement('span', General::sanitize(PageManager::fetchTitleFromHandle($page)));
        $this->appendSubheading(
            isset($parent)
                ? General::sanitize($parent['title'])
                : __('Pages'),
            Widget::Anchor(
                __('Create New'),
                Administration::instance()->getCurrentPageURL() . 'new/' . ($nesting && isset($parent) ? "?parent={$parent['id']}" : null),
                __('Create a new page'),
                'create button',
                null,
                ['accesskey' => 'c']
            )
        );
                $col_title = Widget::TableData(
                    Widget::Anchor(General::sanitize($page_title), $page_edit_url, $page['handle'])
                );
                $col_title->appendChild(
                    Widget::Label(
                        __('Select Page %s', [General::sanitize($page_title)]),
                        null,
                        'accessible',
                        null,
                        ['for' => 'page-' . $page['id']]
                    )
                );
                    $col_params = Widget::TableData(trim(General::sanitize($page['params']), '/'));
                    $col_types = Widget::TableData(implode(', ', array_map(['General', 'sanitize'], $page['type'])));
        $this->setTitle(
            __(
                $title
                    ? '%1$s &ndash; %2$s &ndash; %3$s'
                    : '%2$s &ndash; %3$s',
                [General::sanitize($title), __('Pages'), __('Symphony')]
        );
            $this->appendSubheading(
                General::sanitize($title),
                Widget::Anchor(
                    __('View Page'),
                    $page_url,
                    __('View Page on Frontend'),
                    'button',
                    null,
                    ['target' => '_blank', 'accesskey' => 'v']
                )
            );
            $this->appendSubheading(!empty($title) ? General::sanitize($title) : __('Untitled'));
            $tags->appendChild(new XMLElement('li', General::sanitize($type)));
            'action[save]',
            ($this->_context[0] == 'edit' ? __('Save Changes') : __('Create Page')),
            'submit',
            ['accesskey' => 's']