Vulnerability: In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5
Vulnerability ID: CVE-2020-5271
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: classes/helper/HelperCalendar.php
Commit message: Merge pull request from GHSA-m2x6-c2c6-pjrx

Make sure date_from and date_to are dates
Commit author: GoT

Vulnerable version (before fix):
 public function getDateFormat()         return $this->_date_format;     }      public function setDateFrom($value)     {         if (!isset($value) || $value == '') {             $value = date('Y-m-d', strtotime('-31 days'));         }          if (!is_string($value)) {             throw new PrestaShopException('Date must be a string');         }          $this->_date_from = $value;          return $this;     }      public function getDateFrom()     {         if (!isset($this->_date_from)) {             $this->_date_from = date('Y-m-d', strtotime('-31 days'));         }          return $this->_date_from;     }      public function setDateTo($value)     {         if (!isset($value) || $value == '') {             $value = date('Y-m-d');         }          if (!is_string($value)) {             throw new PrestaShopException('Date must be a string');         }          $this->_date_to = $value;          return $this;     }      public function getDateTo()     {         if (!isset($this->_date_to)) {             $this->_date_to = date('Y-m-d');         }          return $this->_date_to;

Fixed version (after fix):
 public function getDateFormat()         return $this->_date_format;     }      public function setDateFrom($value = '')     {         if (empty($value)) {             $value = strtotime('-31 days');         }          if (!is_string($value)) {             throw new PrestaShopException('Date must be a string');         }          $this->_date_from = date('Y-m-d', strtotime($value));          return $this;     }      public function getDateFrom()     {         if (!isset($this->_date_from)) {             $this->setDateFrom();         }          return $this->_date_from;     }      public function setDateTo($value = '')     {         if (empty($value)) {             $value = strtotime('-31 days');         }          if (!is_string($value)) {             throw new PrestaShopException('Date must be a string');         }          $this->_date_to = date('Y-m-d', strtotime($value));          return $this;     }      public function getDateTo()     {         if (!isset($this->_date_to)) {             $this->setDateTo();         }          return $this->_date_to;

Patch:
patch: @@ -145,49 +145,49 @@ public function getDateFormat()
         return $this->_date_format;
     }
 
-    public function setDateFrom($value)
+    public function setDateFrom($value = '')
     {
-        if (!isset($value) || $value == '') {
-            $value = date('Y-m-d', strtotime('-31 days'));
+        if (empty($value)) {
+            $value = strtotime('-31 days');
         }
 
         if (!is_string($value)) {
             throw new PrestaShopException('Date must be a string');
         }
 
-        $this->_date_from = $value;
+        $this->_date_from = date('Y-m-d', strtotime($value));
 
         return $this;
     }
 
     public function getDateFrom()
     {
         if (!isset($this->_date_from)) {
-            $this->_date_from = date('Y-m-d', strtotime('-31 days'));
+            $this->setDateFrom();
         }
 
         return $this->_date_from;
     }
 
-    public function setDateTo($value)
+    public function setDateTo($value = '')
     {
-        if (!isset($value) || $value == '') {
-            $value = date('Y-m-d');
+        if (empty($value)) {
+            $value = strtotime('-31 days');
         }
 
         if (!is_string($value)) {
             throw new PrestaShopException('Date must be a string');
         }
 
-        $this->_date_to = $value;
+        $this->_date_to = date('Y-m-d', strtotime($value));
 
         return $this;
     }
 
     public function getDateTo()
     {
         if (!isset($this->_date_to)) {
-            $this->_date_to = date('Y-m-d');
+            $this->setDateTo();
         }
 
         return $this->_date_to;
path: classes/helper/HelperCalendar.php