Vulnerability: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Vulnerability ID: CVE-2017-6908
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/concrete5/concrete5-legacy
Published: 2017-03-15
File: web/concrete/tools/files/selector_data.php
Commit message: Fix #1948
Commit author: Michael Krasnow

Vulnerable version (before fix):
 }  $selectedField = Loader::helper('text')->entities($_REQUEST['ccm_file_selected_field']);  $u = new User(); $form = Loader::helper('form');    $f = File::getByID($_REQUEST['fID']); $fp = new Permissions($f); if (!$fp->canViewFileInFileManager()) { 	die(t("Access Denied.")); $canEdit = $fv->canEdit() ? 1 : 0; ?>  <div class="ccm-file-selected" fID="<?=$_REQUEST['fID']?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  > <div class="ccm-file-selected-thumbnail"><?=$fv->getThumbnail(1)?></div> <div class="ccm-file-selected-data"><div><?=$fv->getTitle()?></div><div></div></div> <div class="ccm-spacer">&nbsp;</div> </div>\ No newline at end of file

Fixed version (after fix):
 }  $selectedField = Loader::helper('text')->entities($_REQUEST['ccm_file_selected_field']); $fID = Loader::helper('text')->entities($_REQUEST['fID']);  $u = new User(); $form = Loader::helper('form');    $f = File::getByID($fID); $fp = new Permissions($f); if (!$fp->canViewFileInFileManager()) { 	die(t("Access Denied.")); $canEdit = $fv->canEdit() ? 1 : 0; ?>  <div class="ccm-file-selected" fID="<?=$fID?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  > <div class="ccm-file-selected-thumbnail"><?=$fv->getThumbnail(1)?></div> <div class="ccm-file-selected-data"><div><?=$fv->getTitle()?></div><div></div></div> <div class="ccm-spacer">&nbsp;</div>\ No newline at end of file </div>

Patch:
patch: @@ -6,6 +6,7 @@
 }
 
 $selectedField = Loader::helper('text')->entities($_REQUEST['ccm_file_selected_field']);
+$fID = Loader::helper('text')->entities($_REQUEST['fID']);
 
 $u = new User();
 $form = Loader::helper('form');
@@ -16,7 +17,7 @@
 
 
 
-$f = File::getByID($_REQUEST['fID']);
+$f = File::getByID($fID);
 $fp = new Permissions($f);
 if (!$fp->canViewFileInFileManager()) {
 	die(t("Access Denied."));
@@ -28,8 +29,8 @@
 $canEdit = $fv->canEdit() ? 1 : 0;
 ?>
 
-<div class="ccm-file-selected" fID="<?=$_REQUEST['fID']?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
+<div class="ccm-file-selected" fID="<?=$fID?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
 <div class="ccm-file-selected-thumbnail"><?=$fv->getThumbnail(1)?></div>
 <div class="ccm-file-selected-data"><div><?=$fv->getTitle()?></div><div></div></div>
 <div class="ccm-spacer">&nbsp;</div>
-</div>
\ No newline at end of file
+</div>
path: web/concrete/tools/files/selector_data.php