Vulnerability: Cross-site Scripting in Fork CMS Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
Vulnerability ID: GHSA-qf2g-q4mc-w7rr
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/forkcms/forkcms
Published: 2022-03-25
File: src/Backend/Modules/Extensions/Engine/Model.php
Commit message: Fix xss though the description in the info.xml file of a theme or module
Commit author: Jelmer Prins

Vulnerable version (before fix):
 public static function processModuleXml(\SimpleXMLElement $xml): array         $information['name'] = (string) $module->name;         $information['version'] = (string) $module->version;         $information['requirements'] = (array) $module->requirements;         $information['description'] = (string) $module->description;         $information['cronjobs'] = [];          // authors public static function processThemeXml(\SimpleXMLElement $xml): array         $information['version'] = (string) $theme->version;         $information['requirements'] = (array) $theme->requirements;         $information['thumbnail'] = (string) $theme->thumbnail;         $information['description'] = (string) $theme->description;          // authors         foreach ($xml->xpath('/theme/authors/author') as $author) {

Fixed version (after fix):
 public static function processModuleXml(\SimpleXMLElement $xml): array         $information['name'] = (string) $module->name;         $information['version'] = (string) $module->version;         $information['requirements'] = (array) $module->requirements;         $information['description'] = strip_tags((string) $module->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');         $information['cronjobs'] = [];          // authors public static function processThemeXml(\SimpleXMLElement $xml): array         $information['version'] = (string) $theme->version;         $information['requirements'] = (array) $theme->requirements;         $information['thumbnail'] = (string) $theme->thumbnail;         $information['description'] = strip_tags((string) $theme->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');          // authors         foreach ($xml->xpath('/theme/authors/author') as $author) {

Patch:
patch: @@ -839,7 +839,7 @@ public static function processModuleXml(\SimpleXMLElement $xml): array
         $information['name'] = (string) $module->name;
         $information['version'] = (string) $module->version;
         $information['requirements'] = (array) $module->requirements;
-        $information['description'] = (string) $module->description;
+        $information['description'] = strip_tags((string) $module->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
         $information['cronjobs'] = [];
 
         // authors
@@ -900,7 +900,7 @@ public static function processThemeXml(\SimpleXMLElement $xml): array
         $information['version'] = (string) $theme->version;
         $information['requirements'] = (array) $theme->requirements;
         $information['thumbnail'] = (string) $theme->thumbnail;
-        $information['description'] = (string) $theme->description;
+        $information['description'] = strip_tags((string) $theme->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
 
         // authors
         foreach ($xml->xpath('/theme/authors/author') as $author) {
path: src/Backend/Modules/Extensions/Engine/Model.php