Vulnerability: A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).
Vulnerability ID: CVE-2021-37390
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/chamilo/chamilo-lms
Published: 2021-08-10
File: main/social/search.php
Commit message: Security: Add script tags filter to friends search in social network
Commit author: Yannick Warnier

Vulnerable version (before fix):
     'name' => get_lang('SocialNetwork'), ];  $query = isset($_GET['q']) ? Security::remove_XSS($_GET['q']) : null;  $queryNoFilter = isset($_GET['q']) ? $_GET['q'] : null; $query_search_type = isset($_GET['search_type']) && in_array($_GET['search_type'], ['0', '1', '2']) ? $_GET['search_type'] : null; $extra_fields = UserManager::getExtraFilterableFields(); $query_vars = ['q' => $query, 'search_type' => $query_search_type]; //Block Social Menu $social_menu_block = SocialManager::show_social_menu('search'); $block_search = ''; $searchForm = UserManager::get_search_form($queryNoFilter);  $groups = []; $totalGroups = [];                         </div>                         <div class="user-info">                             '.$item_1.'                             <p>'.$members.'</p>                                 <p>'.$group['description'].'</p>                             <p>'.$tags.'</p>                             <p>'.$url_open.get_lang('SeeMore').$url_close.'</p>

Fixed version (after fix):
     'name' => get_lang('SocialNetwork'), ];  $query = isset($_GET['q']) ? htmlentities($_GET['q']) : null;  $queryNoTags = isset($_GET['q']) ? strip_tags($_GET['q']) : null; $query_search_type = isset($_GET['search_type']) && in_array($_GET['search_type'], ['0', '1', '2']) ? $_GET['search_type'] : null; $extra_fields = UserManager::getExtraFilterableFields(); $query_vars = ['q' => $query, 'search_type' => $query_search_type]; //Block Social Menu $social_menu_block = SocialManager::show_social_menu('search'); $block_search = ''; $searchForm = UserManager::get_search_form($queryNoTags);  $groups = []; $totalGroups = [];                         </div>                         <div class="user-info">                             '.$item_1.'                             <p>'.$members.'</p>                             <p>'.$group['description'].'</p>                             <p>'.$tags.'</p>                             <p>'.$url_open.get_lang('SeeMore').$url_close.'</p>

Patch:
patch: @@ -23,9 +23,9 @@
     'name' => get_lang('SocialNetwork'),
 ];
 
-$query = isset($_GET['q']) ? Security::remove_XSS($_GET['q']) : null;
+$query = isset($_GET['q']) ? htmlentities($_GET['q']) : null;
 
-$queryNoFilter = isset($_GET['q']) ? $_GET['q'] : null;
+$queryNoTags = isset($_GET['q']) ? strip_tags($_GET['q']) : null;
 $query_search_type = isset($_GET['search_type']) && in_array($_GET['search_type'], ['0', '1', '2']) ? $_GET['search_type'] : null;
 $extra_fields = UserManager::getExtraFilterableFields();
 $query_vars = ['q' => $query, 'search_type' => $query_search_type];
@@ -41,7 +41,7 @@
 //Block Social Menu
 $social_menu_block = SocialManager::show_social_menu('search');
 $block_search = '';
-$searchForm = UserManager::get_search_form($queryNoFilter);
+$searchForm = UserManager::get_search_form($queryNoTags);
 
 $groups = [];
 $totalGroups = [];
@@ -201,7 +201,7 @@
                         </div>
                         <div class="user-info">
                             '.$item_1.'
-                            <p>'.$members.'</p>    
+                            <p>'.$members.'</p>
                             <p>'.$group['description'].'</p>
                             <p>'.$tags.'</p>
                             <p>'.$url_open.get_lang('SeeMore').$url_close.'</p>
path: main/social/search.php