Vulnerability: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.
Vulnerability ID: CVE-2020-35132
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/leenooks/phpLDAPadmin
Published: 2020-12-11
File: lib/functions.php
Commit message: Fix error and set by default to preventXSS
Commit author: Genaro Contreras Gutierrez

Vulnerable version (before fix):
 function error($msg,$type='note',$redirect=null,$fatal=false,$backtrace=false) {  *  * @return The form GET/REQUEST/SESSION/POST variable value or its default  */ function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=false) { 	switch($type) { 		case 'GET': 			$value = isset($_GET[$attr]) ? (is_array($_GET[$attr]) ? $_GET[$attr] : (empty($_GET['nodecode'][$attr]) ? rawurldecode($_GET[$attr]) : $_GET[$attr])) : $default; function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal 		system_message(array( 			'title'=>_('Generic Error'), 			'body'=>sprintf('%s: Called "%s" without "%s" using "%s"', 				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST',false,null,true),preventXSS($attr),preventXSS($type)), 			'type'=>'error'), 			'index.php'); 	if($preventXSS && !is_null($value)) function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal *  Prevent XSS function. This function can usage has preventXSS(get_request('cmd','REQUEST')) *  Return valor escape XSS. */ function preventXSS($value){ 	return htmlspecialchars(addslashes($value), ENT_QUOTES, 'UTF-8'); }   * Record a system message.  * This function can be used as an alternative to generate a system message, if page hasnt yet been defined.  */

Fixed version (after fix):
 function error($msg,$type='note',$redirect=null,$fatal=false,$backtrace=false) {  *  * @return The form GET/REQUEST/SESSION/POST variable value or its default  */ function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=true) { 	switch($type) { 		case 'GET': 			$value = isset($_GET[$attr]) ? (is_array($_GET[$attr]) ? $_GET[$attr] : (empty($_GET['nodecode'][$attr]) ? rawurldecode($_GET[$attr]) : $_GET[$attr])) : $default; function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal 		system_message(array( 			'title'=>_('Generic Error'), 			'body'=>sprintf('%s: Called "%s" without "%s" using "%s"', 				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST'),preventXSS($attr),preventXSS($type)), 			'type'=>'error'), 			'index.php'); 	if($preventXSS && !is_null($value)) function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal *  Prevent XSS function. This function can usage has preventXSS(get_request('cmd','REQUEST')) *  Return valor escape XSS. */  function preventXSS($data){         if (gettype($data) == 'array') {             foreach ($data as $key => $value) {                 if (gettype($value) == 'array')                     $data[$key] = preventXSS($value);                 else                     $data[$key] = htmlspecialchars($value);             }             return $data;         }         return htmlspecialchars($data, ENT_QUOTES, 'UTF-8'); }  /*  * Record a system message.  * This function can be used as an alternative to generate a system message, if page hasnt yet been defined.  */

Patch:
patch: @@ -651,7 +651,7 @@ function error($msg,$type='note',$redirect=null,$fatal=false,$backtrace=false) {
  *
  * @return The form GET/REQUEST/SESSION/POST variable value or its default
  */
-function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=false) {
+function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=true) {
 	switch($type) {
 		case 'GET':
 			$value = isset($_GET[$attr]) ? (is_array($_GET[$attr]) ? $_GET[$attr] : (empty($_GET['nodecode'][$attr]) ? rawurldecode($_GET[$attr]) : $_GET[$attr])) : $default;
@@ -675,7 +675,7 @@ function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal
 		system_message(array(
 			'title'=>_('Generic Error'),
 			'body'=>sprintf('%s: Called "%s" without "%s" using "%s"',
-				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST',false,null,true),preventXSS($attr),preventXSS($type)),
+				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST'),preventXSS($attr),preventXSS($type)),
 			'type'=>'error'),
 			'index.php');
 	if($preventXSS && !is_null($value))
@@ -686,10 +686,20 @@ function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal
 *  Prevent XSS function. This function can usage has preventXSS(get_request('cmd','REQUEST'))
 *  Return valor escape XSS.
 */
-function preventXSS($value){
-	return htmlspecialchars(addslashes($value), ENT_QUOTES, 'UTF-8');
-}
-
+ function preventXSS($data){
+        if (gettype($data) == 'array') {
+            foreach ($data as $key => $value) {
+                if (gettype($value) == 'array')
+                    $data[$key] = preventXSS($value);
+                else
+                    $data[$key] = htmlspecialchars($value);
+            }
+            return $data;
+        }
+        return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
+}
+
+/*
  * Record a system message.
  * This function can be used as an alternative to generate a system message, if page hasnt yet been defined.
  */
path: lib/functions.php