Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.
Vulnerability ID: CVE-2011-3371
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/punbb/punbb
Published: 2011-10-02
File: include/functions.php
Commit message: Fix XSS vulnerabilities described on http://seclists.org/fulldisclosure/2011/Sep/158
Commit author: ashcs

Vulnerable version (before fix):
 /**  * Loads common functions used throughout the site.  *  * @copyright (C) 2008-2009 PunBB, partially based on code (C) 2008-2009 FluxBB.org  * @license http://www.gnu.org/licenses/gpl.html GPL version 2 or higher  * @package PunBB  */ function _csrf_confirm_form($key, $values) 		<div class="ct-box info-box"> 			<p><?php echo $lang_common['CSRF token mismatch'] ?></p> 		</div> 		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $forum_page['form_action'] ?>"> 			<div class="hidden"> 				<?php echo implode("\n\t\t\t\t", $forum_page['hidden_fields'])."\n" ?> 			</div>

Fixed version (after fix):
 /**  * Loads common functions used throughout the site.  *  * @copyright (C) 2008-2011 PunBB, partially based on code (C) 2008-2009 FluxBB.org  * @license http://www.gnu.org/licenses/gpl.html GPL version 2 or higher  * @package PunBB  */ function _csrf_confirm_form($key, $values) 		<div class="ct-box info-box"> 			<p><?php echo $lang_common['CSRF token mismatch'] ?></p> 		</div> 		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo forum_htmlencode($forum_page['form_action']) ?>"> 			<div class="hidden"> 				<?php echo implode("\n\t\t\t\t", $forum_page['hidden_fields'])."\n" ?> 			</div>

Patch:
patch: @@ -2,7 +2,7 @@
 /**
  * Loads common functions used throughout the site.
  *
- * @copyright (C) 2008-2009 PunBB, partially based on code (C) 2008-2009 FluxBB.org
+ * @copyright (C) 2008-2011 PunBB, partially based on code (C) 2008-2009 FluxBB.org
  * @license http://www.gnu.org/licenses/gpl.html GPL version 2 or higher
  * @package PunBB
  */
@@ -2672,7 +2672,7 @@ function _csrf_confirm_form($key, $values)
 		<div class="ct-box info-box">
 			<p><?php echo $lang_common['CSRF token mismatch'] ?></p>
 		</div>
-		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $forum_page['form_action'] ?>">
+		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo forum_htmlencode($forum_page['form_action']) ?>">
 			<div class="hidden">
 				<?php echo implode("\n\t\t\t\t", $forum_page['hidden_fields'])."\n" ?>
 			</div>
path: include/functions.php