Vulnerability: Cross-site Scripting in facturascripts Reflected cross-site scripting using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.08. This can lead to theft of a user's cookies, which in turn could lead to account takeover or do other malicious activities in a victim's browser.
Vulnerability ID: GHSA-6465-r752-2h8v
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/neorazorx/facturascripts
Published: 2022-05-13
File: Core/Controller/EditPageOption.php
Commit message: We check the url parameter of the link to ensure that it is a valid controller.
------
Comprobamos el parámetro url del enlace para asegurar que sea un controlador válido.
Commit author: Carlos Garcia Gomez

Vulnerable version (before fix):
 use FacturaScripts\Core\Base\DataBase\DataBaseWhere; use FacturaScripts\Core\Lib\Widget\VisualItemLoadEngine; use FacturaScripts\Dinamic\Model\CodeModel; use FacturaScripts\Dinamic\Model\PageOption; use FacturaScripts\Dinamic\Model\User; use Symfony\Component\HttpFoundation\Response; public function privateCore(&$response, $user, $permissions)         parent::privateCore($response, $user, $permissions);         $this->model = new PageOption();         $this->loadSelectedViewName();         $this->backPage = $this->request->get('url') ?: $this->selectedViewName;         $this->selectedUser = $this->user->admin ? $this->request->get('nick') : $this->user->nick;         $this->loadPageOptions();  private function loadPageOptionsForUser(): bool         return true;     }      /**      * @param array $column      * @param string $name

Fixed version (after fix):
 use FacturaScripts\Core\Base\DataBase\DataBaseWhere; use FacturaScripts\Core\Lib\Widget\VisualItemLoadEngine; use FacturaScripts\Dinamic\Model\CodeModel; use FacturaScripts\Dinamic\Model\Page; use FacturaScripts\Dinamic\Model\PageOption; use FacturaScripts\Dinamic\Model\User; use Symfony\Component\HttpFoundation\Response; public function privateCore(&$response, $user, $permissions)         parent::privateCore($response, $user, $permissions);         $this->model = new PageOption();         $this->loadSelectedViewName();         $this->setBackPage();         $this->selectedUser = $this->user->admin ? $this->request->get('nick') : $this->user->nick;         $this->loadPageOptions();  private function loadPageOptionsForUser(): bool         return true;     }      private function setBackPage()     {         // check if the url is a real controller name         $url = $this->request->get('url', '');         $pageModel = new Page();         foreach ($pageModel->all([], [], 0, 0) as $page) {             if (substr($url, 0, strlen($page->name)) === $page->name) {                 $this->backPage = $url;                 return;             }         }          // set the default back page         $this->backPage = $this->selectedViewName;     }      /**      * @param array $column      * @param string $name

Patch:
patch: @@ -24,6 +24,7 @@
 use FacturaScripts\Core\Base\DataBase\DataBaseWhere;
 use FacturaScripts\Core\Lib\Widget\VisualItemLoadEngine;
 use FacturaScripts\Dinamic\Model\CodeModel;
+use FacturaScripts\Dinamic\Model\Page;
 use FacturaScripts\Dinamic\Model\PageOption;
 use FacturaScripts\Dinamic\Model\User;
 use Symfony\Component\HttpFoundation\Response;
@@ -121,7 +122,7 @@ public function privateCore(&$response, $user, $permissions)
         parent::privateCore($response, $user, $permissions);
         $this->model = new PageOption();
         $this->loadSelectedViewName();
-        $this->backPage = $this->request->get('url') ?: $this->selectedViewName;
+        $this->setBackPage();
         $this->selectedUser = $this->user->admin ? $this->request->get('nick') : $this->user->nick;
         $this->loadPageOptions();
 
@@ -275,6 +276,22 @@ private function loadPageOptionsForUser(): bool
         return true;
     }
 
+    private function setBackPage()
+    {
+        // check if the url is a real controller name
+        $url = $this->request->get('url', '');
+        $pageModel = new Page();
+        foreach ($pageModel->all([], [], 0, 0) as $page) {
+            if (substr($url, 0, strlen($page->name)) === $page->name) {
+                $this->backPage = $url;
+                return;
+            }
+        }
+
+        // set the default back page
+        $this->backPage = $this->selectedViewName;
+    }
+
     /**
      * @param array $column
      * @param string $name
path: Core/Controller/EditPageOption.php