Vulnerability: Microweber before v1.2.20 vulnerable to cross-site scripting Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery (CSRF), fetch contents from same-site and redirect a user.
Vulnerability ID: GHSA-gmh3-x5w7-jg5m
CWE: CWE-79
Severity score: 6.3
Project: https://github.com/microweber/microweber
Published: 2022-07-10
File: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
     if (isset($_GET['autosize'])) {         $autoSize = $_GET['autosize'];     }     $autoSize = xss_clean($autoSize);      $type = '';     if (isset($_GET['type'])) {         $type = $_GET['type'];     }     $type = xss_clean($type);      $mod_id = $mod_orig_id = false;     $is_linked_mod = false;      if ($mod_id != $mod_orig_id) {         $is_linked_mod = true;     }     ?>      <script type="text/javascript">         addIcon();          autoSize = <?php  print $autoSize; ?>;         settingsType = '<?php print $type; ?>';          window.onbeforeunload = function () {             $(document.body).addClass("mw-external-loading")

Fixed version (after fix):
     if (isset($_GET['autosize'])) {         $autoSize = $_GET['autosize'];     }     $autoSize = intval($autoSize);      $type = '';     if (isset($_GET['type'])) {         $type = $_GET['type'];     }     $type = xss_clean($type);              $other = [                 ';',                 '\'',                 '//',                 '`',                 '\\',              ];     $type = str_replace($other, '', $type);      $mod_id = $mod_orig_id = false;     $is_linked_mod = false;      if ($mod_id != $mod_orig_id) {         $is_linked_mod = true;     }       ?>      <script type="text/javascript">         addIcon();          autoSize = <?php  print $autoSize; ?>;         settingsType = '<?php print htmlentities($type); ?>';          window.onbeforeunload = function () {             $(document.body).addClass("mw-external-loading")

Patch:
patch: @@ -87,14 +87,24 @@
     if (isset($_GET['autosize'])) {
         $autoSize = $_GET['autosize'];
     }
-    $autoSize = xss_clean($autoSize);
+    $autoSize = intval($autoSize);
 
     $type = '';
     if (isset($_GET['type'])) {
         $type = $_GET['type'];
     }
     $type = xss_clean($type);
 
+            $other = [
+                ';',
+                '\'',
+                '//',
+                '`',
+                '\\',
+
+            ];
+    $type = str_replace($other, '', $type);
+
     $mod_id = $mod_orig_id = false;
     $is_linked_mod = false;
 
@@ -108,6 +118,8 @@
     if ($mod_id != $mod_orig_id) {
         $is_linked_mod = true;
     }
+
+
     ?>
 
     <script type="text/javascript">
@@ -124,7 +136,7 @@
         addIcon();
 
         autoSize = <?php  print $autoSize; ?>;
-        settingsType = '<?php print $type; ?>';
+        settingsType = '<?php print htmlentities($type); ?>';
 
         window.onbeforeunload = function () {
             $(document.body).addClass("mw-external-loading")
path: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php