Vulnerability: Cross-site Scripting in microweber Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Vulnerability ID: GHSA-m8rp-q82r-c5mf
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/microweber/microweber
Published: 2022-01-21
File: userfiles/modules/admin/notifications/notif_form_entry.php
Commit message: xss on contact form fix
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
             <hr class="thin" />             <div class="row">                   <?php                 $iformVr=0;                 foreach ($form_values_formated as $form_values_row) {                             <?php if (!is_array($val1)){ ?>                                 <div>                                     <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>                                     <p><?php print $val1; ?></p>                                 </div>                             <?php } else { ?>                                 <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>                                 <?php foreach ($val1 as $val1_1){ ?>                                     <p><?php print $val1_1 . '<br />'; ?></p>                                 <?php }?>                             <?php } ?>                         <?php } ?>

Fixed version (after fix):
             <hr class="thin" />             <div class="row">                  <?php                 $iformVr=0;                 foreach ($form_values_formated as $form_values_row) {                             <?php if (!is_array($val1)){ ?>                                 <div>                                     <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>                                     <p><?php print htmlentities($val1); ?></p>                                 </div>                             <?php } else { ?>                                 <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>                                 <?php foreach ($val1 as $val1_1){ ?>                                     <p><?php print htmlentities($val1_1) . '<br />'; ?></p>                                 <?php }?>                             <?php } ?>                         <?php } ?>

Patch:
patch: @@ -91,7 +91,6 @@
             <hr class="thin" />
             <div class="row">
 
-
                 <?php
                 $iformVr=0;
                 foreach ($form_values_formated as $form_values_row) {
@@ -106,12 +105,12 @@
                             <?php if (!is_array($val1)){ ?>
                                 <div>
                                     <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
-                                    <p><?php print $val1; ?></p>
+                                    <p><?php print htmlentities($val1); ?></p>
                                 </div>
                             <?php } else { ?>
                                 <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
                                 <?php foreach ($val1 as $val1_1){ ?>
-                                    <p><?php print $val1_1 . '<br />'; ?></p>
+                                    <p><?php print htmlentities($val1_1) . '<br />'; ?></p>
                                 <?php }?>
                             <?php } ?>
                         <?php } ?>
path: userfiles/modules/admin/notifications/notif_form_entry.php