Vulnerability: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.
Vulnerability ID: CVE-2014-4742
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/kajona/kajonacms
Published: 2014-07-09
File: module_system/system/class_link.php
Commit message: BUG / SECURITY: module_system | class_link -> fixed some rare conditions where a possible xss injection was possible for the systemid-param
Commit author: sidler

Vulnerable version (before fix):
 public static function getLinkPortalHref($strPageI, $strPageE = "", $strAction =           //create an array out of the params         $strParsedSystemid = "";         $arrParams = self::parseParamsString($strParams, $strParsedSystemid);         if($strSystemid == "" && validateSystemid($strParsedSystemid))             $strSystemid = $strParsedSystemid;          // any anchors set to the page?         $strAnchor = ""; private static function parseParamsString($strParams, &$strSystemid = "") {             $arrEntry = explode("=", $strValue);              if(count($arrEntry) == 2 && $arrEntry[0] == "systemid") {                 $strSystemid = $arrEntry[1];                 unset($arrParams[$strKey]);             }             else if($strValue == "")

Fixed version (after fix):
 public static function getLinkPortalHref($strPageI, $strPageE = "", $strAction =           //create an array out of the params         if($strSystemid != "") {             $strParams .= "&systemid=".$strSystemid;             $strSystemid = "";         }          $arrParams = self::parseParamsString($strParams, $strSystemid);          // any anchors set to the page?         $strAnchor = ""; private static function parseParamsString($strParams, &$strSystemid = "") {             $arrEntry = explode("=", $strValue);              if(count($arrEntry) == 2 && $arrEntry[0] == "systemid") {                 //encoded and sanitized systemid param TODO: add cve number or other identifier                 $strSystemid = urlencode($arrEntry[1]);                 if(!validateSystemid($strSystemid))                     $strSystemid = "";                  unset($arrParams[$strKey]);             }             else if($strValue == "")

Patch:
patch: @@ -347,10 +347,12 @@ public static function getLinkPortalHref($strPageI, $strPageE = "", $strAction =
 
 
         //create an array out of the params
-        $strParsedSystemid = "";
-        $arrParams = self::parseParamsString($strParams, $strParsedSystemid);
-        if($strSystemid == "" && validateSystemid($strParsedSystemid))
-            $strSystemid = $strParsedSystemid;
+        if($strSystemid != "") {
+            $strParams .= "&systemid=".$strSystemid;
+            $strSystemid = "";
+        }
+
+        $arrParams = self::parseParamsString($strParams, $strSystemid);
 
         // any anchors set to the page?
         $strAnchor = "";
@@ -496,7 +498,11 @@ private static function parseParamsString($strParams, &$strSystemid = "") {
             $arrEntry = explode("=", $strValue);
 
             if(count($arrEntry) == 2 && $arrEntry[0] == "systemid") {
-                $strSystemid = $arrEntry[1];
+                //encoded and sanitized systemid param TODO: add cve number or other identifier
+                $strSystemid = urlencode($arrEntry[1]);
+                if(!validateSystemid($strSystemid))
+                    $strSystemid = "";
+
                 unset($arrParams[$strKey]);
             }
             else if($strValue == "")
path: module_system/system/class_link.php