index,vul_code,is_vulnerable,programming_language,method_name,file_name,repo_url,repo_owner,committer,committer_date,commit_msg,cwe_id,cwe_name,cwe_description,cwe_url,cve_id,patch
0,"function block_email_request($email) { if ( $this->is_blocked($email) ) return false; $subject = __('E-mail block confirmation', 'subscribe-to-comments'); $message = sprintf(__(""You are receiving this message to confirm that you no longer wish to receive e-mail comment notifications from \""%s\""\n\n"", 'subscribe-to-comments'), get_bloginfo('name')); $message .= __(""To cancel all future notifications for this address, click this link:\n\n"", 'subscribe-to-comments'); $message .= get_bloginfo('wpurl') . ""/wp-subscription-manager.php?email="" . $email . ""&key="" . $this->generate_key($email . 'blockrequest') . ""&blockemailconfirm=true"" . "".\n\n""; $message .= __(""If you did not request this action, please disregard this message."", 'subscribe-to-comments'); return $this->send_mail($email, $subject, $message); }",True,PHP,block_email_request,subscribe-to-comments.php,https://github.com/wp-plugins/subscribe-to-comments,wp-plugins,markjaquith,2006-09-17 06:38:32+00:00,"version 2.0.8, XSS fix thanks to MustLive, more fixes for addresses with + symbols
git-svn-id: https://plugins.svn.wordpress.org/subscribe-to-comments/trunk@6401 b8457f37-d9ea-0310-8a92-e5e31aec5664",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2006-10001,"function block_email_request($email) { if ( $this->is_blocked($email) ) return false; $subject = __('E-mail block confirmation', 'subscribe-to-comments'); $message = sprintf(__(""You are receiving this message to confirm that you no longer wish to receive e-mail comment notifications from \""%s\""\n\n"", 'subscribe-to-comments'), get_bloginfo('name')); $message .= __(""To cancel all future notifications for this address, click this link:\n\n"", 'subscribe-to-comments'); $message .= get_bloginfo('wpurl') . ""/wp-subscription-manager.php?email="" . urlencode($email) . ""&key="" . $this->generate_key($email . 'blockrequest') . ""&blockemailconfirm=true"" . "".\n\n""; $message .= __(""If you did not request this action, please disregard this message."", 'subscribe-to-comments'); return $this->send_mail($email, $subject, $message); }"
1,"function change_email_request() { if ( $this->is_blocked() ) return false; $subject = __('E-mail change confirmation', 'subscribe-to-comments'); $message = sprintf(__(""You are receiving this message to confirm a change of e-mail address for your subscriptions at \""%s\""\n\n"", 'subscribe-to-comments'), get_bloginfo('blogname')); $message .= sprintf(__(""To change your e-mail address to %s, click this link:\n\n"", 'subscribe-to-comments'), $this->new_email); $message .= get_bloginfo('wpurl') . ""/wp-subscription-manager.php?email="" . $this->email . ""&new_email="" . $this->new_email . ""&key="" . $this->generate_key($this->email . $this->new_email) . "".\n\n""; $message .= __('If you did not request this action, please disregard this message.', 'subscribe-to-comments'); return $this->send_mail($this->email, $subject, $message); }",True,PHP,change_email_request,subscribe-to-comments.php,https://github.com/wp-plugins/subscribe-to-comments,wp-plugins,markjaquith,2006-09-17 06:38:32+00:00,"version 2.0.8, XSS fix thanks to MustLive, more fixes for addresses with + symbols
git-svn-id: https://plugins.svn.wordpress.org/subscribe-to-comments/trunk@6401 b8457f37-d9ea-0310-8a92-e5e31aec5664",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2006-10001,"function change_email_request() { if ( $this->is_blocked() ) return false; $subject = __('E-mail change confirmation', 'subscribe-to-comments'); $message = sprintf(__(""You are receiving this message to confirm a change of e-mail address for your subscriptions at \""%s\""\n\n"", 'subscribe-to-comments'), get_bloginfo('blogname')); $message .= sprintf(__(""To change your e-mail address to %s, click this link:\n\n"", 'subscribe-to-comments'), $this->new_email); $message .= get_bloginfo('wpurl') . ""/wp-subscription-manager.php?email="" . urlencode($this->email) . ""&new_email="" . urlencode($this->new_email) . ""&key="" . $this->generate_key($this->email . $this->new_email) . "".\n\n""; $message .= __('If you did not request this action, please disregard this message.', 'subscribe-to-comments'); return $this->send_mail($this->email, $subject, $message); }"
4,"$email = strtolower($comment_author_email); } else { return false; } $post_author = get_userdata($post->post_author); if ( strtolower($post_author->user_email) == $email && $loggedin ) return 'admin'; if ( is_array($this->subscriptions_from_email($email)) ) if ( in_array($post->ID, $this->email_subscriptions) ) return $email; return false; }",True,PHP,strtolower,subscribe-to-comments.php,https://github.com/wp-plugins/subscribe-to-comments,wp-plugins,markjaquith,2006-09-17 06:38:32+00:00,"version 2.0.8, XSS fix thanks to MustLive, more fixes for addresses with + symbols
git-svn-id: https://plugins.svn.wordpress.org/subscribe-to-comments/trunk@6401 b8457f37-d9ea-0310-8a92-e5e31aec5664",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2006-10001,"function manage_link($email='', $html=true, $echo=true) { $link = get_bloginfo('wpurl') . '/wp-subscription-manager.php'; if ( $email != 'admin' ) { $link = add_query_arg('email', urlencode(urlencode($email)), $link); $link = add_query_arg('key', $this->generate_key($email), $link); } $link = add_query_arg('ref', urlencode('http: $link = str_replace('+', '%2B', $link); if ( $html ) $link = htmlentities($link); if ( !$echo ) return $link; echo $link; }"
5,"function manage_link($email='', $html=true, $echo=true) { $link = get_bloginfo('wpurl') . '/wp-subscription-manager.php'; if ( $email != 'admin' ) { $link = add_query_arg('email', urlencode($email), $link); $link = add_query_arg('key', $this->generate_key($email), $link); } $link = add_query_arg('ref', urlencode('http: if ( $html ) $link = htmlentities($link); if ( !$echo ) return $link; echo $link; }",True,PHP,manage_link,subscribe-to-comments.php,https://github.com/wp-plugins/subscribe-to-comments,wp-plugins,markjaquith,2006-09-17 06:38:32+00:00,"version 2.0.8, XSS fix thanks to MustLive, more fixes for addresses with + symbols
git-svn-id: https://plugins.svn.wordpress.org/subscribe-to-comments/trunk@6401 b8457f37-d9ea-0310-8a92-e5e31aec5664",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2006-10001,"function show_manual_subscription_form () { global $id, $sg_subscribe, $user_email; sg_subscribe_start(); $sg_subscribe->show_errors('solo_subscribe', '
', '
', __('Error: ', 'subscribe-to-comments'), ' '); if ( !$sg_subscribe->current_viewer_subscription_status() ) : get_currentuserinfo(); ?> "" /> "" /> {$var} = trim($_REQUEST[$var]); } if ( !$this->key ) $this->key = 'unset'; },True,PHP,trim,subscribe-to-comments.php,https://github.com/wp-plugins/subscribe-to-comments,wp-plugins,markjaquith,2006-09-17 06:38:32+00:00,"version 2.0.8, XSS fix thanks to MustLive, more fixes for addresses with + symbols
git-svn-id: https://plugins.svn.wordpress.org/subscribe-to-comments/trunk@6401 b8457f37-d9ea-0310-8a92-e5e31aec5664",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2006-10001,"public function recipient($address) { return $this->sendCommand( 'RCPT TO', 'RCPT TO:<' . $address . '>', array(250, 251) ); }"
8,"function show_manual_subscription_form () { global $id, $sg_subscribe, $user_email; sg_subscribe_start(); $sg_subscribe->show_errors('solo_subscribe', '
', '
', __('Error: ', 'subscribe-to-comments'), ' '); if ( !$sg_subscribe->current_viewer_subscription_status() ) : get_currentuserinfo(); ?> "" /> "" /> Mail->SMTPDebug = 4; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP single connect failed'); $this->Mail->smtpClose(); $this->Mail->Host = ""ssl: $this->assertFalse($this->Mail->smtpConnect(), 'SMTP bad multi-connect succeeded'); $this->Mail->smtpClose(); $this->Mail->Host = ""localhost:12345;10.10.10.10:54321;"" . $_REQUEST['mail_host']; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP multi-connect failed'); $this->Mail->smtpClose(); $this->Mail->Host = "" localhost:12345 ; "" . $_REQUEST['mail_host'] . ' '; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP hosts with stray spaces failed'); $this->Mail->smtpClose(); $this->Mail->Host = $_REQUEST['mail_host']; $this->assertTrue( $this->Mail->smtpConnect(array('ssl' => array('verify_depth' => 10))), 'SMTP connect with options failed' ); }"
12,"public function recipient($toaddr) { return $this->sendCommand( 'RCPT TO', 'RCPT TO:<' . $toaddr . '>', array(250, 251) ); }",True,PHP,recipient,class.smtp.php,https://github.com/PHPMailer/PHPMailer,PHPMailer,Synchro,2015-11-01 11:12:04+01:00,"Add test for line breaks in addresses vulnerability
Don't allow line breaks in addresses
Don't allow line breaks in SMTP commands
Rearrange tests so slowest tests run last",CWE-20,Improper Input Validation,"The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.",https://cwe.mitre.org/data/definitions/20.html,CVE-2015-8476,"public function testValidate() { $validaddresses = array( 'first@iana.org', 'first.last@iana.org', '1234567890123456789012345678901234567890123456789012345678901234@iana.org', '""first\""last""@iana.org', '""first@last""@iana.org', '""first\last""@iana.org', 'first.last@[12.34.56.78]', 'first.last@[IPv6:::12.34.56.78]', 'first.last@[IPv6:1111:2222:3333::4444:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:12.34.56.78]', 'first.last@[IPv6:::1111:2222:3333:4444:5555:6666]', 'first.last@[IPv6:1111:2222:3333::4444:5555:6666]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666::]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:8888]', 'first.last@x23456789012345678901234567890123456789012345678901234567890123.iana.org', 'first.last@3com.com', 'first.last@123.iana.org', '""first\last""@iana.org', 'first.last@[IPv6:1111:2222:3333::4444:5555:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333::4444:5555:6666:7777]', 'first.last@example.123', 'first.last@com', '""Abc\@def""@iana.org', '""Fred\ Bloggs""@iana.org', '""Joe.\Blow""@iana.org', '""Abc@def""@iana.org', 'user+mailbox@iana.org', 'customer/department=shipping@iana.org', '$A12345@iana.org', '!def!xyz%abc@iana.org', '_somename@iana.org', 'dclo@us.ibm.com', 'peter.piper@iana.org', '""Doug \""Ace\"" L.""@iana.org', 'test@iana.org', 'TEST@iana.org', '1234567890@iana.org', 'test+test@iana.org', 'test-test@iana.org', 't*est@iana.org', '+1~1+@iana.org', '{_test_}@iana.org', '""[[ test ]]""@iana.org', 'test.test@iana.org', '""test.test""@iana.org', 'test.""test""@iana.org', '""test@test""@iana.org', 'test@123.123.123.x123', 'test@123.123.123.123', 'test@[123.123.123.123]', 'test@example.iana.org', 'test@example.example.iana.org', '""test\test""@iana.org', 'test@example', '""test\blah""@iana.org', '""test\blah""@iana.org', '""test\""blah""@iana.org', 'customer/department@iana.org', '_Yosemite.Sam@iana.org', '~@iana.org', '""Austin@Powers""@iana.org', 'Ima.Fool@iana.org', '""Ima.Fool""@iana.org', '""Ima Fool""@iana.org', '""first"".""last""@iana.org', '""first"".middle.""last""@iana.org', '""first"".last@iana.org', 'first.""last""@iana.org', '""first"".""middle"".""last""@iana.org', '""first.middle"".""last""@iana.org', '""first.middle.last""@iana.org', '""first..last""@iana.org', '""first\""last""@iana.org', 'first.""mid\dle"".""last""@iana.org', '""test blah""@iana.org', '(foo)cal(bar)@(baz)iamcal.com(quux)', 'cal@iamcal(woo).(yay)com', 'cal(woo(yay)hoopla)@iamcal.com', 'cal(foo\@bar)@iamcal.com', 'cal(foo\)bar)@iamcal.com', 'first().last@iana.org', 'pete(his account)@silly.test(his host)', 'c@(Chris\'s host.)public.example', 'jdoe@machine(comment). example', '1234 @ local(blah) .machine .example', 'first(abc.def).last@iana.org', 'first(a""bc.def).last@iana.org', 'first.("")middle.last("")@iana.org', 'first(abc\(def)@iana.org', 'first.last@x(1234567890123456789012345678901234567890123456789012345678901234567890).com', 'a(a(b(c)d(e(f))g)h(i)j)@iana.org', 'name.lastname@domain.com', 'a@b', 'a@bar.com', 'aaa@[123.123.123.123]', 'a@bar', 'a-b@bar.com', '+@b.c', '+@b.com', 'a@b.co-foo.uk', '""hello my name is""@stutter.com', '""Test \""Fail\"" Ing""@iana.org', 'valid@about.museum', 'shaitan@my-domain.thisisminekthx', 'foobar@192.168.0.1', '""Joe\Blow""@iana.org', 'HM2Kinsists@(that comments are allowed)this.is.ok', 'user%uucp!path@berkeley.edu', 'first.last @iana.org', 'cdburgess+! 'first.last@[IPv6:::a2:a3:a4:b1:b2:b3:b4]', 'first.last@[IPv6:a1:a2:a3:a4:b1:b2:b3::]', 'first.last@[IPv6:::]', 'first.last@[IPv6:::b4]', 'first.last@[IPv6:::b3:b4]', 'first.last@[IPv6:a1::b4]', 'first.last@[IPv6:a1::]', 'first.last@[IPv6:a1:a2::]', 'first.last@[IPv6:0123:4567:89ab:cdef::]', 'first.last@[IPv6:0123:4567:89ab:CDEF::]', 'first.last@[IPv6:::a3:a4:b1:ffff:11.22.33.44]', 'first.last@[IPv6:::a2:a3:a4:b1:ffff:11.22.33.44]', 'first.last@[IPv6:a1:a2:a3:a4::11.22.33.44]', 'first.last@[IPv6:a1:a2:a3:a4:b1::11.22.33.44]', 'first.last@[IPv6:a1::11.22.33.44]', 'first.last@[IPv6:a1:a2::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:cdef::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:CDEF::11.22.33.44]', 'first.last@[IPv6:a1::b2:11.22.33.44]', 'test@test.com', 'test@xn--example.com', 'test@example.com' ); $invalidaddresses = array( 'first.last@sub.do,com', 'first\@last@iana.org', '123456789012345678901234567890123456789012345678901234567890' . '@12345678901234567890123456789012345678901234 [...]', 'first.last', '12345678901234567890123456789012345678901234567890123456789012345@iana.org', '.first.last@iana.org', 'first.last.@iana.org', 'first..last@iana.org', '""first""last""@iana.org', '""""""@iana.org', '""\""@iana.org', 'first\@last@iana.org', 'first.last@', 'x@x23456789.x23456789.x23456789.x23456789.x23456789.x23456789.x23456789.' . 'x23456789.x23456789.x23456789.x23 [...]', 'first.last@[.12.34.56.78]', 'first.last@[12.34.56.789]', 'first.last@[::12.34.56.78]', 'first.last@[IPv5:::12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:8888:9999]', 'first.last@[IPv6:1111:2222::3333::4444:5555:6666]', 'first.last@[IPv6:1111:2222:333x::4444:5555]', 'first.last@[IPv6:1111:2222:33333::4444:5555]', 'first.last@-xample.com', 'first.last@exampl-.com', 'first.last@x234567890123456789012345678901234567890123456789012345678901234.iana.org', 'abc\@def@iana.org', 'abc\@iana.org', 'Doug\ \""Ace\""\ Lovell@iana.org', 'abc@def@iana.org', 'abc\@def@iana.org', 'abc\@iana.org', '@iana.org', 'doug@', '""qu@iana.org', 'ote""@iana.org', '.dot@iana.org', 'dot.@iana.org', 'two..dot@iana.org', '""Doug ""Ace"" L.""@iana.org', 'Doug\ \""Ace\""\ L\.@iana.org', 'hello world@iana.org', 'gatsby@f.sc.ot.t.f.i.tzg.era.l.d.', 'test.iana.org', 'test.@iana.org', 'test..test@iana.org', '.test@iana.org', 'test@test@iana.org', 'test@@iana.org', '-- test --@iana.org', '[test]@iana.org', '""test""test""@iana.org', '()[]\;:,><@iana.org', 'test@.', 'test@example.', 'test@.org', 'test@12345678901234567890123456789012345678901234567890123456789012345678901234567890' . '12345678901234567890 [...]', 'test@[123.123.123.123', 'test@123.123.123.123]', 'NotAnEmail', '@NotAnEmail', '""test""blah""@iana.org', '.wooly@iana.org', 'wo..oly@iana.org', 'pootietang.@iana.org', '.@iana.org', 'Ima Fool@iana.org', 'phil.h\@\@ck@haacked.com', 'foo@[\1.2.3.4]', 'first\last@iana.org', 'Abc\@def@iana.org', 'Fred\ Bloggs@iana.org', 'Joe.\Blow@iana.org', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:12.34.567.89]', '{^c\@**Dog^}@cartoon.com', 'cal(foo(bar)@iamcal.com', 'cal(foo)bar)@iamcal.com', 'cal(foo\)@iamcal.com', 'first(12345678901234567890123456789012345678901234567890)last@(1234567890123456789' . '01234567890123456789012 [...]', 'first(middle)last@iana.org', 'first(abc(""def"".ghi).mno)middle(abc(""def"".ghi).mno).last@(abc(""def"".ghi).mno)example' . '(abc(""def"".ghi).mno). [...]', 'a(a(b(c)d(e(f))g)(h(i)j)@iana.org', '.@', '@bar.com', '@@bar.com', 'aaa.com', 'aaa@.com', 'aaa@.123', 'aaa@[123.123.123.123]a', 'aaa@[123.123.123.333]', 'a@bar.com.', 'a@-b.com', 'a@b-.com', '-@..com', '-@a..com', 'invalid@about.museum-', 'test@...........com', '""Unicode NULL' . chr(0) . '""@char.com', 'Unicode NULL' . chr(0) . '@char.com', 'first.last@[IPv6::]', 'first.last@[IPv6::::]', 'first.last@[IPv6::b4]', 'first.last@[IPv6::::b4]', 'first.last@[IPv6::b3:b4]', 'first.last@[IPv6::::b3:b4]', 'first.last@[IPv6:a1:::b4]', 'first.last@[IPv6:a1:]', 'first.last@[IPv6:a1:::]', 'first.last@[IPv6:a1:a2:]', 'first.last@[IPv6:a1:a2:::]', 'first.last@[IPv6::11.22.33.44]', 'first.last@[IPv6::::11.22.33.44]', 'first.last@[IPv6:a1:11.22.33.44]', 'first.last@[IPv6:a1:::11.22.33.44]', 'first.last@[IPv6:a1:a2:::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:cdef::11.22.33.xx]', 'first.last@[IPv6:0123:4567:89ab:CDEFF::11.22.33.44]', 'first.last@[IPv6:a1::a4:b1::b4:11.22.33.44]', 'first.last@[IPv6:a1::11.22.33]', 'first.last@[IPv6:a1::11.22.33.44.55]', 'first.last@[IPv6:a1::b211.22.33.44]', 'first.last@[IPv6:a1::b2::11.22.33.44]', 'first.last@[IPv6:a1::b3:]', 'first.last@[IPv6::a2::b4]', 'first.last@[IPv6:a1:a2:a3:a4:b1:b2:b3:]', 'first.last@[IPv6::a2:a3:a4:b1:b2:b3:b4]', 'first.last@[IPv6:a1:a2:a3:a4::b1:b2:b3:b4]', ""(\r\n RCPT TO:websec02@d.mbsd.jp\r\n DATA \\\nSubject: spam10\\\n\r\n Hello,\r\n this is a spam mail.\\\n.\r\n QUIT\r\n ) a@gmail.com"" ); $unicodeaddresses = array( 'first.last@bücher.ch', 'first.last@кто.рф', 'first.last@phplíst.com', ); $asciiaddresses = array( 'first.last@xn--bcher-kva.ch', 'first.last@xn--j1ail.xn--p1ai', 'first.last@xn--phplst-6va.com', ); $goodfails = array(); foreach (array_merge($validaddresses, $asciiaddresses) as $address) { if (!PHPMailer::validateAddress($address)) { $goodfails[] = $address; } } $badpasses = array(); foreach (array_merge($invalidaddresses, $unicodeaddresses) as $address) { if (PHPMailer::validateAddress($address)) { $badpasses[] = $address; } } $err = ''; if (count($goodfails) > 0) { $err .= ""Good addresses that failed validation:\n""; $err .= implode(""\n"", $goodfails); } if (count($badpasses) > 0) { if (!empty($err)) { $err .= ""\n\n""; } $err .= ""Bad addresses that passed validation:\n""; $err .= implode(""\n"", $badpasses); } $this->assertEmpty($err, $err); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'auto')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'auto')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'pcre')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'pcre')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'pcre8')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'pcre8')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'php')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'php')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'noregex')); $this->assertFalse(PHPMailer::validateAddress('bad', 'noregex')); }"
14,"public function testSmtpConnect() { $this->Mail->SMTPDebug = 4; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP single connect failed'); $this->Mail->smtpClose(); $this->Mail->Host = ""ssl: $this->assertFalse($this->Mail->smtpConnect(), 'SMTP bad multi-connect succeeded'); $this->Mail->smtpClose(); $this->Mail->Host = ""localhost:12345;10.10.10.10:54321;"" . $_REQUEST['mail_host']; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP multi-connect failed'); $this->Mail->smtpClose(); $this->Mail->Host = "" localhost:12345 ; "" . $_REQUEST['mail_host'] . ' '; $this->assertTrue($this->Mail->smtpConnect(), 'SMTP hosts with stray spaces failed'); $this->Mail->smtpClose(); $this->Mail->Host = $_REQUEST['mail_host']; $this->assertTrue( $this->Mail->smtpConnect(array('ssl' => array('verify_depth' => 10))), 'SMTP connect with options failed' ); }",True,PHP,testSmtpConnect,phpmailerTest.php,https://github.com/PHPMailer/PHPMailer,PHPMailer,Synchro,2015-11-01 11:12:04+01:00,"Add test for line breaks in addresses vulnerability
Don't allow line breaks in addresses
Don't allow line breaks in SMTP commands
Rearrange tests so slowest tests run last",CWE-20,Improper Input Validation,"The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.",https://cwe.mitre.org/data/definitions/20.html,CVE-2015-8476,"public function testPopBeforeSmtpBad() { $pid = shell_exec('nohup ./runfakepopserver.sh 1101 >/dev/null 2>/dev/null & printf ""%u"" $!'); $this->pids[] = $pid; sleep(2); $this->assertFalse( POP3::popBeforeSmtp('localhost', 1101, 10, 'user', 'xxx', $this->Mail->SMTPDebug), 'POP before SMTP should have failed' ); shell_exec('kill -TERM ' . escapeshellarg($pid)); sleep(2); }"
15,"public function testValidate() { $validaddresses = array( 'first@iana.org', 'first.last@iana.org', '1234567890123456789012345678901234567890123456789012345678901234@iana.org', '""first\""last""@iana.org', '""first@last""@iana.org', '""first\last""@iana.org', 'first.last@[12.34.56.78]', 'first.last@[IPv6:::12.34.56.78]', 'first.last@[IPv6:1111:2222:3333::4444:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:12.34.56.78]', 'first.last@[IPv6:::1111:2222:3333:4444:5555:6666]', 'first.last@[IPv6:1111:2222:3333::4444:5555:6666]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666::]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:8888]', 'first.last@x23456789012345678901234567890123456789012345678901234567890123.iana.org', 'first.last@3com.com', 'first.last@123.iana.org', '""first\last""@iana.org', 'first.last@[IPv6:1111:2222:3333::4444:5555:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333::4444:5555:6666:7777]', 'first.last@example.123', 'first.last@com', '""Abc\@def""@iana.org', '""Fred\ Bloggs""@iana.org', '""Joe.\Blow""@iana.org', '""Abc@def""@iana.org', '""Fred Bloggs""@iana.org', 'user+mailbox@iana.org', 'customer/department=shipping@iana.org', '$A12345@iana.org', '!def!xyz%abc@iana.org', '_somename@iana.org', 'dclo@us.ibm.com', 'peter.piper@iana.org', '""Doug \""Ace\"" L.""@iana.org', 'test@iana.org', 'TEST@iana.org', '1234567890@iana.org', 'test+test@iana.org', 'test-test@iana.org', 't*est@iana.org', '+1~1+@iana.org', '{_test_}@iana.org', '""[[ test ]]""@iana.org', 'test.test@iana.org', '""test.test""@iana.org', 'test.""test""@iana.org', '""test@test""@iana.org', 'test@123.123.123.x123', 'test@123.123.123.123', 'test@[123.123.123.123]', 'test@example.iana.org', 'test@example.example.iana.org', '""test\test""@iana.org', 'test@example', '""test\blah""@iana.org', '""test\blah""@iana.org', '""test\""blah""@iana.org', 'customer/department@iana.org', '_Yosemite.Sam@iana.org', '~@iana.org', '""Austin@Powers""@iana.org', 'Ima.Fool@iana.org', '""Ima.Fool""@iana.org', '""Ima Fool""@iana.org', '""first"".""last""@iana.org', '""first"".middle.""last""@iana.org', '""first"".last@iana.org', 'first.""last""@iana.org', '""first"".""middle"".""last""@iana.org', '""first.middle"".""last""@iana.org', '""first.middle.last""@iana.org', '""first..last""@iana.org', '""first\""last""@iana.org', 'first.""mid\dle"".""last""@iana.org', '""test blah""@iana.org', '(foo)cal(bar)@(baz)iamcal.com(quux)', 'cal@iamcal(woo).(yay)com', 'cal(woo(yay)hoopla)@iamcal.com', 'cal(foo\@bar)@iamcal.com', 'cal(foo\)bar)@iamcal.com', 'first().last@iana.org', 'pete(his account)@silly.test(his host)', 'c@(Chris\'s host.)public.example', 'jdoe@machine(comment). example', '1234 @ local(blah) .machine .example', 'first(abc.def).last@iana.org', 'first(a""bc.def).last@iana.org', 'first.("")middle.last("")@iana.org', 'first(abc\(def)@iana.org', 'first.last@x(1234567890123456789012345678901234567890123456789012345678901234567890).com', 'a(a(b(c)d(e(f))g)h(i)j)@iana.org', 'name.lastname@domain.com', 'a@b', 'a@bar.com', 'aaa@[123.123.123.123]', 'a@bar', 'a-b@bar.com', '+@b.c', '+@b.com', 'a@b.co-foo.uk', '""hello my name is""@stutter.com', '""Test \""Fail\"" Ing""@iana.org', 'valid@about.museum', 'shaitan@my-domain.thisisminekthx', 'foobar@192.168.0.1', '""Joe\Blow""@iana.org', 'HM2Kinsists@(that comments are allowed)this.is.ok', 'user%uucp!path@berkeley.edu', 'first.last @iana.org', 'cdburgess+! 'first.last@[IPv6:::a2:a3:a4:b1:b2:b3:b4]', 'first.last@[IPv6:a1:a2:a3:a4:b1:b2:b3::]', 'first.last@[IPv6:::]', 'first.last@[IPv6:::b4]', 'first.last@[IPv6:::b3:b4]', 'first.last@[IPv6:a1::b4]', 'first.last@[IPv6:a1::]', 'first.last@[IPv6:a1:a2::]', 'first.last@[IPv6:0123:4567:89ab:cdef::]', 'first.last@[IPv6:0123:4567:89ab:CDEF::]', 'first.last@[IPv6:::a3:a4:b1:ffff:11.22.33.44]', 'first.last@[IPv6:::a2:a3:a4:b1:ffff:11.22.33.44]', 'first.last@[IPv6:a1:a2:a3:a4::11.22.33.44]', 'first.last@[IPv6:a1:a2:a3:a4:b1::11.22.33.44]', 'first.last@[IPv6:a1::11.22.33.44]', 'first.last@[IPv6:a1:a2::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:cdef::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:CDEF::11.22.33.44]', 'first.last@[IPv6:a1::b2:11.22.33.44]', 'test@test.com', 'test@xn--example.com', 'test@example.com', ); $invalidaddresses = array( 'first.last@sub.do,com', 'first\@last@iana.org', '123456789012345678901234567890123456789012345678901234567890' . '@12345678901234567890123456789012345678901234 [...]', 'first.last', '12345678901234567890123456789012345678901234567890123456789012345@iana.org', '.first.last@iana.org', 'first.last.@iana.org', 'first..last@iana.org', '""first""last""@iana.org', '""""""@iana.org', '""\""@iana.org', 'first\@last@iana.org', 'first.last@', 'x@x23456789.x23456789.x23456789.x23456789.x23456789.x23456789.x23456789.' . 'x23456789.x23456789.x23456789.x23 [...]', 'first.last@[.12.34.56.78]', 'first.last@[12.34.56.789]', 'first.last@[::12.34.56.78]', 'first.last@[IPv5:::12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:12.34.56.78]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777]', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:7777:8888:9999]', 'first.last@[IPv6:1111:2222::3333::4444:5555:6666]', 'first.last@[IPv6:1111:2222:333x::4444:5555]', 'first.last@[IPv6:1111:2222:33333::4444:5555]', 'first.last@-xample.com', 'first.last@exampl-.com', 'first.last@x234567890123456789012345678901234567890123456789012345678901234.iana.org', 'abc\@def@iana.org', 'abc\@iana.org', 'Doug\ \""Ace\""\ Lovell@iana.org', 'abc@def@iana.org', 'abc\@def@iana.org', 'abc\@iana.org', '@iana.org', 'doug@', '""qu@iana.org', 'ote""@iana.org', '.dot@iana.org', 'dot.@iana.org', 'two..dot@iana.org', '""Doug ""Ace"" L.""@iana.org', 'Doug\ \""Ace\""\ L\.@iana.org', 'hello world@iana.org', 'gatsby@f.sc.ot.t.f.i.tzg.era.l.d.', 'test.iana.org', 'test.@iana.org', 'test..test@iana.org', '.test@iana.org', 'test@test@iana.org', 'test@@iana.org', '-- test --@iana.org', '[test]@iana.org', '""test""test""@iana.org', '()[]\;:,><@iana.org', 'test@.', 'test@example.', 'test@.org', 'test@12345678901234567890123456789012345678901234567890123456789012345678901234567890' . '12345678901234567890 [...]', 'test@[123.123.123.123', 'test@123.123.123.123]', 'NotAnEmail', '@NotAnEmail', '""test""blah""@iana.org', '.wooly@iana.org', 'wo..oly@iana.org', 'pootietang.@iana.org', '.@iana.org', 'Ima Fool@iana.org', 'phil.h\@\@ck@haacked.com', 'foo@[\1.2.3.4]', 'first\last@iana.org', 'Abc\@def@iana.org', 'Fred\ Bloggs@iana.org', 'Joe.\Blow@iana.org', 'first.last@[IPv6:1111:2222:3333:4444:5555:6666:12.34.567.89]', '{^c\@**Dog^}@cartoon.com', 'cal(foo(bar)@iamcal.com', 'cal(foo)bar)@iamcal.com', 'cal(foo\)@iamcal.com', 'first(12345678901234567890123456789012345678901234567890)last@(1234567890123456789' . '01234567890123456789012 [...]', 'first(middle)last@iana.org', 'first(abc(""def"".ghi).mno)middle(abc(""def"".ghi).mno).last@(abc(""def"".ghi).mno)example' . '(abc(""def"".ghi).mno). [...]', 'a(a(b(c)d(e(f))g)(h(i)j)@iana.org', '.@', '@bar.com', '@@bar.com', 'aaa.com', 'aaa@.com', 'aaa@.123', 'aaa@[123.123.123.123]a', 'aaa@[123.123.123.333]', 'a@bar.com.', 'a@-b.com', 'a@b-.com', '-@..com', '-@a..com', 'invalid@about.museum-', 'test@...........com', '""Unicode NULL' . chr(0) . '""@char.com', 'Unicode NULL' . chr(0) . '@char.com', 'first.last@[IPv6::]', 'first.last@[IPv6::::]', 'first.last@[IPv6::b4]', 'first.last@[IPv6::::b4]', 'first.last@[IPv6::b3:b4]', 'first.last@[IPv6::::b3:b4]', 'first.last@[IPv6:a1:::b4]', 'first.last@[IPv6:a1:]', 'first.last@[IPv6:a1:::]', 'first.last@[IPv6:a1:a2:]', 'first.last@[IPv6:a1:a2:::]', 'first.last@[IPv6::11.22.33.44]', 'first.last@[IPv6::::11.22.33.44]', 'first.last@[IPv6:a1:11.22.33.44]', 'first.last@[IPv6:a1:::11.22.33.44]', 'first.last@[IPv6:a1:a2:::11.22.33.44]', 'first.last@[IPv6:0123:4567:89ab:cdef::11.22.33.xx]', 'first.last@[IPv6:0123:4567:89ab:CDEFF::11.22.33.44]', 'first.last@[IPv6:a1::a4:b1::b4:11.22.33.44]', 'first.last@[IPv6:a1::11.22.33]', 'first.last@[IPv6:a1::11.22.33.44.55]', 'first.last@[IPv6:a1::b211.22.33.44]', 'first.last@[IPv6:a1::b2::11.22.33.44]', 'first.last@[IPv6:a1::b3:]', 'first.last@[IPv6::a2::b4]', 'first.last@[IPv6:a1:a2:a3:a4:b1:b2:b3:]', 'first.last@[IPv6::a2:a3:a4:b1:b2:b3:b4]', 'first.last@[IPv6:a1:a2:a3:a4::b1:b2:b3:b4]', ); $unicodeaddresses = array( 'first.last@bücher.ch', 'first.last@кто.рф', 'first.last@phplíst.com', ); $asciiaddresses = array( 'first.last@xn--bcher-kva.ch', 'first.last@xn--j1ail.xn--p1ai', 'first.last@xn--phplst-6va.com', ); $goodfails = array(); foreach (array_merge($validaddresses, $asciiaddresses) as $address) { if (!PHPMailer::validateAddress($address)) { $goodfails[] = $address; } } $badpasses = array(); foreach (array_merge($invalidaddresses, $unicodeaddresses) as $address) { if (PHPMailer::validateAddress($address)) { $badpasses[] = $address; } } $err = ''; if (count($goodfails) > 0) { $err .= ""Good addresses that failed validation:\n""; $err .= implode(""\n"", $goodfails); } if (count($badpasses) > 0) { if (!empty($err)) { $err .= ""\n\n""; } $err .= ""Bad addresses that passed validation:\n""; $err .= implode(""\n"", $badpasses); } $this->assertEmpty($err, $err); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'auto')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'auto')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'pcre')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'pcre')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'pcre8')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'pcre8')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'php')); $this->assertFalse(PHPMailer::validateAddress('test@example.com.', 'php')); $this->assertTrue(PHPMailer::validateAddress('test@example.com', 'noregex')); $this->assertFalse(PHPMailer::validateAddress('bad', 'noregex')); }",True,PHP,testValidate,phpmailerTest.php,https://github.com/PHPMailer/PHPMailer,PHPMailer,Synchro,2015-11-01 11:12:04+01:00,"Add test for line breaks in addresses vulnerability
Don't allow line breaks in addresses
Don't allow line breaks in SMTP commands
Rearrange tests so slowest tests run last",CWE-20,Improper Input Validation,"The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.",https://cwe.mitre.org/data/definitions/20.html,CVE-2015-8476,"public function testPopBeforeSmtpGood() { $pid = shell_exec('nohup ./runfakepopserver.sh >/dev/null 2>/dev/null & printf ""%u"" $!'); $this->pids[] = $pid; sleep(2); $this->assertTrue( POP3::popBeforeSmtp('localhost', 1100, 10, 'user', 'test', $this->Mail->SMTPDebug), 'POP before SMTP failed' ); shell_exec('kill -TERM ' . escapeshellarg($pid)); sleep(2); }"
19,"public function testPopBeforeSmtpGood() { $pid = shell_exec('nohup ./runfakepopserver.sh >/dev/null 2>/dev/null & printf ""%u"" $!'); $this->pids[] = $pid; sleep(2); $this->assertTrue( POP3::popBeforeSmtp('localhost', 1100, 10, 'user', 'test', $this->Mail->SMTPDebug), 'POP before SMTP failed' ); shell_exec('kill -TERM '.escapeshellarg($pid)); sleep(2); }",True,PHP,testPopBeforeSmtpGood,phpmailerTest.php,https://github.com/PHPMailer/PHPMailer,PHPMailer,Synchro,2015-11-01 11:12:04+01:00,"Add test for line breaks in addresses vulnerability
Don't allow line breaks in addresses
Don't allow line breaks in SMTP commands
Rearrange tests so slowest tests run last",CWE-20,Improper Input Validation,"The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.",https://cwe.mitre.org/data/definitions/20.html,CVE-2015-8476,"public function testCustomValidator() { self::assertTrue( PHPMailer::validateAddress( 'user@example.com', function ($address) { return strpos($address, '@') !== false; } ), 'Custom validator false negative' ); self::assertFalse( PHPMailer::validateAddress( 'userexample.com', function ($address) { return strpos($address, '@') !== false; } ), 'Custom validator false positive' ); PHPMailer::$validator = function ($address) { return 'user@example.com' === $address; }; self::assertTrue( $this->Mail->addAddress('user@example.com'), 'Custom default validator false negative' ); self::assertFalse( $this->Mail->addAddress('bananas@example.com'), 'Custom default validator false positive' ); PHPMailer::$validator = 'php'; self::assertFalse( $this->Mail->addAddress('first.last@example.123'), 'PHP validator not behaving as expected' ); self::assertTrue(PHPMailer::validateAddress('test@example.com', 'php')); self::assertTrue(PHPMailer::validateAddress('test@example.com', 'phpx')); }"
27,"public function testCustomValidator() { self::assertTrue( PHPMailer::validateAddress( 'user@example.com', function ($address) { return strpos($address, '@') !== false; } ), 'Custom validator false negative' ); self::assertFalse( PHPMailer::validateAddress( 'userexample.com', function ($address) { return strpos($address, '@') !== false; } ), 'Custom validator false positive' ); PHPMailer::$validator = function ($address) { return 'user@example.com' === $address; }; self::assertTrue( $this->Mail->addAddress('user@example.com'), 'Custom default validator false negative' ); self::assertFalse( $this->Mail->addAddress('bananas@example.com'), 'Custom default validator false positive' ); PHPMailer::$validator = 'php'; self::assertFalse( $this->Mail->addAddress('first.last@example.123'), 'PHP validator not behaving as expected' ); self::assertTrue(PHPMailer::validateAddress('test@example.com', 'php')); self::assertFalse(PHPMailer::validateAddress('test@example.com', 'phpx')); }",True,PHP,testCustomValidator,PHPMailerTest.php,https://github.com/PHPMailer/PHPMailer,PHPMailer,Marcus Bointon,2021-06-15 17:37:24+02:00,Deny string-based callables altogether,CWE-829,Inclusion of Functionality from Untrusted Control Sphere,"The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.",https://cwe.mitre.org/data/definitions/829.html,CVE-2021-3603,"function getByPlugins($database, $plugins, $phrase, $partial_match) { $phrase_escaped = $database->getEscaped($phrase, true); $count = count($plugins); for ($i = 0; $i < $count; $i++) { $result = call_user_func($plugins[$i], $database, $phrase_escaped, $partial_match); if (count($result) == 2) { return $result; } } return null; }"
28,"function password_check($oldpassword, $profile_id) { global $db_user_id, $db_group_id, $db_user_name, $db_user_email, $db_user_password, $db_table_user_name; global $db_table_group_name, $auth_user_class, $auth_alt_user_class, $table_prefix, $db_raid, $phpraid_config; global $pwd_hasher; $sql_passchk = sprintf(""SELECT "" . $db_user_password . "" FROM "" . $table_prefix . $db_table_user_name . "" WHERE "" . $db_user_id . "" = %s"", quote_smart($profile_id) ); $result_passchk = $db_raid->sql_query($sql_passchk) or print_error($sql_passchk, mysql_error(), 1); $data_passchk = $db_raid->sql_fetchrow($result_passchk, true); $db_pass = $data_passchk[$db_user_password]; $initString = '$H$'; $testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass); if ($testVal) return 0; else return 1; }",True,PHP,password_check,auth_phpbb3.php,https://github.com/Illydth/wowraidmanager,Illydth,Douglas Wagner,2008-10-13 16:26:19-05:00,Bug Fix: Fixes problem with phpBB3 bridge allowing login with ANY password.,CWE-255,Credentials Management Errors,Weaknesses in this category are related to the management of credentials.,https://cwe.mitre.org/data/definitions/255.html,CVE-2008-7050,"function plugin_contentTitle($database, $phrase, $partial_match = true) { global $mainframe; if(!class_exists('ContentHelperRoute')) { require_once( JPATH_SITE.DS.'components'.DS.'com_content'.DS.'helpers'.DS.'route.php' ); } $result = null; $query = ""SELECT a.id, a.title AS arttitle, a.alias AS artalias, c.id as catid, c.alias AS catalias, a.sectionid""; $query .= "" FROM $query .= "" LEFT JOIN $query .= "" LEFT JOIN $where_clause = "" WHERE a.state=1 ""; $where_variant = "" AND a.alias "" . (($partial_match) ? "" LIKE "".$database->quote('%'.$phrase.'%', false) : ""= "".$database->quote($phrase, false));"
31,"function getByPlugins($database, $plugins, $phrase, $partial_match) { $count = count($plugins); for ($i = 0; $i < $count; $i++) { $result = call_user_func($plugins[$i], $database, $phrase, $partial_match); if (count($result) == 2) { return $result; } } return null; }",True,PHP,getByPlugins,titlelink.php,https://github.com/gesellix/titlelink,gesellix,Tobias Gesellchen,2010-08-08 18:17:54+00:00,"[#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php
git-svn-id: http://joomlacode.org/svn/titlelink@27 de31ee7e-3f2c-0410-b67e-83f64df8b4ac",CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'),"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",https://cwe.mitre.org/data/definitions/89.html,CVE-2010-10003,function getValue() { $ret = SecurityManager::formPrep($this->value); if(empty($ret)) { return $this->default; } return $ret; }
33,"function plugin_contentTitle($database, $phrase, $partial_match = true) { global $mainframe; if(!class_exists('ContentHelperRoute')) { require_once( JPATH_SITE.DS.'components'.DS.'com_content'.DS.'helpers'.DS.'route.php' ); } $result = null; $query = ""SELECT a.id, a.title AS arttitle, a.alias AS artalias, c.id as catid, c.alias AS catalias, a.sectionid""; $query .= "" FROM $query .= "" LEFT JOIN $query .= "" LEFT JOIN $where_clause = "" WHERE a.state=1 ""; $where_variant = "" AND a.alias "" . (($partial_match) ? "" LIKE '%$phrase%'"" : ""= '$phrase'"");",True,PHP,plugin_contentTitle,plugin_content_title.php,https://github.com/gesellix/titlelink,gesellix,Tobias Gesellchen,2010-08-08 18:17:54+00:00,"[#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php
git-svn-id: http://joomlacode.org/svn/titlelink@27 de31ee7e-3f2c-0410-b67e-83f64df8b4ac",CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'),"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",https://cwe.mitre.org/data/definitions/89.html,CVE-2010-10003,"public function Handshake($AuthenticationSchemeAlias = 'default') { try { if (!Gdn::Authenticator()->CanHandshake()) throw new Exception(); $Authenticator = Gdn::Authenticator()->AuthenticateWith($AuthenticationSchemeAlias); $Payload = $Authenticator->GetHandshake(); if ($Payload === FALSE) { Gdn::Request()->WithURI('dashboard/entry/auth/password'); return Gdn::Dispatcher()->Dispatch(); } } catch (Exception $e) { Gdn::Request()->WithURI('/entry/signin'); return Gdn::Dispatcher()->Dispatch(); } $UserInfo = array( 'UserKey' => $Authenticator->GetUserKeyFromHandshake($Payload), 'ConsumerKey' => $Authenticator->GetProviderKeyFromHandshake($Payload), 'TokenKey' => $Authenticator->GetTokenKeyFromHandshake($Payload), 'UserName' => $Authenticator->GetUserNameFromHandshake($Payload), 'UserEmail' => $Authenticator->GetUserEmailFromHandshake($Payload) ); $SyncScreen = C('Garden.Authenticator.SyncScreen', 'on'); switch ($SyncScreen) { case 'on': $this->SyncScreen($Authenticator, $UserInfo, $Payload); break; case 'off': case 'smart': $UserID = $this->UserModel->Synchronize($UserInfo['UserKey'], array( 'Name' => $UserInfo['UserName'], 'Email' => $UserInfo['UserEmail'] )); if ($UserID > 0) { $Authenticator->Finalize($UserInfo['UserKey'], $UserID, $UserInfo['ConsumerKey'], $UserInfo['TokenKey'], $Payload); $Route = $this->RedirectTo(); if ($Route !== FALSE) Redirect($Route); else Redirect('/'); } else { if ($SyncScreen == 'smart') { $this->StatusMessage = T('There is already an account in this forum using your email address. Please create a new account, or enter the credentials for the existing account.'); $this->SyncScreen($Authenticator, $UserInfo, $Payload); } else { $CookiePayload = array( 'Sync' => 'Failed' ); $SerializedCookiePayload = Gdn_Format::Serialize($CookiePayload); $Authenticator->Remember($UserInfo['ConsumerKey'], $SerializedCookiePayload); Gdn::Request()->WithRoute('DefaultController'); $this->SelfUrl = Url(''); $this->View = 'syncfailed'; $this->ProviderSite = $Authenticator->GetProviderUrl(); $this->Render(); } } break; } }"
39,function getValue() { $ret = $this->value; if(empty($ret)) { return $this->default; } return $ret; },True,PHP,getValue,Field.php,https://github.com/frioux/ptome,frioux,JohnBOren,2010-01-11 06:15:24+00:00,"Security update to thwart SQL injection (previously, magic_quotes_gpc was saving us)",CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'),"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",https://cwe.mitre.org/data/definitions/89.html,CVE-2010-10009,"protected function _AnalyzeRequest(&$Request, $FolderDepth = 1) { $this->_ApplicationFolder = ''; $this->_ControllerFolder = ''; $this->_ControllerName = ''; $this->_ControllerMethod = 'index'; $this->_ControllerMethodArgs = array(); $this->Request = Url(''); $PathAndQuery = $Request->PathAndQuery(); $MatchRoute = Gdn::Router()->MatchRoute($PathAndQuery); if ($MatchRoute !== FALSE) { switch ($MatchRoute['Type']) { case 'Internal': $Request->PathAndQuery($MatchRoute['FinalDestination']); $this->Request = $MatchRoute['FinalDestination']; break; case 'Temporary': Header( ""HTTP/1.1 302 Moved Temporarily"" ); Header( ""Location: "".$MatchRoute['FinalDestination'] ); exit(); break; case 'Permanent': Header( ""HTTP/1.1 301 Moved Permanently"" ); Header( ""Location: "".$MatchRoute['FinalDestination'] ); exit(); break; case 'NotFound': Header( ""HTTP/1.1 404 Not Found"" ); $this->Request = $MatchRoute['FinalDestination']; break; } } switch ($Request->OutputFormat()) { case 'rss': $this->_SyndicationMethod = SYNDICATION_RSS; break; case 'atom': $this->_SyndicationMethod = SYNDICATION_ATOM; break; case 'default': default: $this->_SyndicationMethod = SYNDICATION_NONE; break; } if ($this->Request == '') { $DefaultController = Gdn::Router()->GetRoute('DefaultController'); $this->Request = $DefaultController['Destination']; } $Parts = explode('/', $this->Request); $Length = count($Parts); if ($Length == 1 || $FolderDepth <= 0) { $FolderDepth = 0; $this->_ControllerName = $Parts[0]; $this->_MapParts($Parts, 0); $this->_FetchController(TRUE); } else if ($Length == 2) { $FolderDepth = 1; } if ($FolderDepth == 2) { $this->_ApplicationFolder = $Parts[0]; $this->_ControllerFolder = $Parts[1]; $this->_MapParts($Parts, 2); if (!$this->_FetchController()) { $this->_AnalyzeRequest($Request, 1); } } else if ($FolderDepth == 1) { $Found = FALSE; if (in_array($Parts[0], $this->EnabledApplicationFolders())) { $this->_ApplicationFolder = $Parts[0]; $this->_MapParts($Parts, 1); $Found = $this->_FetchController(); } if (!$Found) { $this->_ApplicationFolder = ''; $this->_ControllerFolder = $Parts[0]; $this->_MapParts($Parts, 1); if (!$this->_FetchController()) { $this->_AnalyzeRequest($Request, 0); } } } }"
42,"public function Handshake($AuthenticationSchemeAlias = 'default') { try { if (!Gdn::Authenticator()->CanHandshake()) throw new Exception(); $Authenticator = Gdn::Authenticator()->AuthenticateWith($AuthenticationSchemeAlias); $Payload = $Authenticator->GetHandshake(); if ($Payload === FALSE) { Gdn::Request()->WithURI('dashboard/entry/auth/password'); return Gdn::Dispatcher()->Dispatch(); } } catch (Exception $e) { Gdn::Request()->WithURI('/entry/signin'); return Gdn::Dispatcher()->Dispatch(); } $UserInfo = array( 'UserKey' => $Authenticator->GetUserKeyFromHandshake($Payload), 'ConsumerKey' => $Authenticator->GetProviderKeyFromHandshake($Payload), 'TokenKey' => $Authenticator->GetTokenKeyFromHandshake($Payload), 'UserName' => $Authenticator->GetUserNameFromHandshake($Payload), 'UserEmail' => $Authenticator->GetUserEmailFromHandshake($Payload) ); $SyncScreen = C('Garden.Authenticator.SyncScreen', 'on'); switch ($SyncScreen) { case 'on': $this->SyncScreen($Authenticator, $UserInfo, $Payload); break; case 'off': case 'smart': $UserID = $this->UserModel->Synchronize($UserInfo['UserKey'], array( 'Name' => $UserInfo['UserName'], 'Email' => $UserInfo['UserEmail'] )); if ($UserID > 0) { $Authenticator->Finalize($UserInfo['UserKey'], $UserID, $UserInfo['ConsumerKey'], $UserInfo['TokenKey'], $Payload); $Route = $this->RedirectTo(); if ($Route !== FALSE) Redirect($Route); else Redirect('/'); } else { if ($SyncScreen == 'smart') { $this->StatusMessage = T('There is already an account in this forum using your email address. Please create a new account, or enter the credentials for the existing account.'); $this->SyncScreen($Authenticator, $UserInfo, $Payload); } else { $CookiePayload = array( 'Sync' => 'Failed' ); $SerializedCookiePayload = Gdn_Format::Serialize($CookiePayload); $Authenticator->Remember($UserInfo['ConsumerKey'], $SerializedCookiePayload); Gdn::Request()->WithRoute('DefaultController'); $this->SelfUrl = Gdn::Request()->Path(); $this->View = 'syncfailed'; $this->ProviderSite = $Authenticator->GetProviderUrl(); $this->Render(); } } break; } }",True,PHP,Handshake,class.entrycontroller.php,https://github.com/vanilla/vanilla,vanilla,Tim Gunter,2010-09-27 11:22:20-04:00,Fixed XSS vulnerability where filename could contain abitrary code to execute on the client side.,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2010-4264,"public function startup(Event $event) { $controller = $event->subject(); $request = $controller->request; $response = $controller->response; $cookieName = $this->_config['cookieName']; $cookieData = $request->cookie($cookieName); if ($cookieData) { $request->params['_csrfToken'] = $cookieData; } if ($request->is('requested')) { return; } if ($request->is('get') && $cookieData === null) { $this->_setCookie($request, $response); } if (!$request->is(['head', 'get', 'options'])) { $this->_validateToken($request); unset($request->data[$this->_config['field']]); } }"
44,"protected function _AnalyzeRequest(&$Request, $FolderDepth = 1) { $this->_ApplicationFolder = ''; $this->_ControllerFolder = ''; $this->_ControllerName = ''; $this->_ControllerMethod = 'index'; $this->_ControllerMethodArgs = array(); $this->Request = $Request->Path(); $PathAndQuery = $Request->PathAndQuery(); $MatchRoute = Gdn::Router()->MatchRoute($PathAndQuery); if ($MatchRoute !== FALSE) { switch ($MatchRoute['Type']) { case 'Internal': $Request->PathAndQuery($MatchRoute['FinalDestination']); $this->Request = $MatchRoute['FinalDestination']; break; case 'Temporary': Header( ""HTTP/1.1 302 Moved Temporarily"" ); Header( ""Location: "".$MatchRoute['FinalDestination'] ); exit(); break; case 'Permanent': Header( ""HTTP/1.1 301 Moved Permanently"" ); Header( ""Location: "".$MatchRoute['FinalDestination'] ); exit(); break; case 'NotFound': Header( ""HTTP/1.1 404 Not Found"" ); $this->Request = $MatchRoute['FinalDestination']; break; } } switch ($Request->OutputFormat()) { case 'rss': $this->_SyndicationMethod = SYNDICATION_RSS; break; case 'atom': $this->_SyndicationMethod = SYNDICATION_ATOM; break; case 'default': default: $this->_SyndicationMethod = SYNDICATION_NONE; break; } if ($this->Request == '') { $DefaultController = Gdn::Router()->GetRoute('DefaultController'); $this->Request = $DefaultController['Destination']; } $Parts = explode('/', $this->Request); $Length = count($Parts); if ($Length == 1 || $FolderDepth <= 0) { $FolderDepth = 0; $this->_ControllerName = $Parts[0]; $this->_MapParts($Parts, 0); $this->_FetchController(TRUE); } else if ($Length == 2) { $FolderDepth = 1; } if ($FolderDepth == 2) { $this->_ApplicationFolder = $Parts[0]; $this->_ControllerFolder = $Parts[1]; $this->_MapParts($Parts, 2); if (!$this->_FetchController()) { $this->_AnalyzeRequest($Request, 1); } } else if ($FolderDepth == 1) { $Found = FALSE; if (in_array($Parts[0], $this->EnabledApplicationFolders())) { $this->_ApplicationFolder = $Parts[0]; $this->_MapParts($Parts, 1); $Found = $this->_FetchController(); } if (!$Found) { $this->_ApplicationFolder = ''; $this->_ControllerFolder = $Parts[0]; $this->_MapParts($Parts, 1); if (!$this->_FetchController()) { $this->_AnalyzeRequest($Request, 0); } } } }",True,PHP,_AnalyzeRequest,class.dispatcher.php,https://github.com/vanilla/vanilla,vanilla,Tim Gunter,2010-09-27 11:22:20-04:00,Fixed XSS vulnerability where filename could contain abitrary code to execute on the client side.,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2010-4264,"public static function httpMethodProvider() { return [ ['PATCH'], ['PUT'], ['POST'], ['DELETE'], ['PURGE'], ['INVALIDMETHOD'] ]; }"
50,"public function startup(Event $event) { $controller = $event->subject(); $request = $controller->request; $response = $controller->response; $cookieName = $this->_config['cookieName']; $cookieData = $request->cookie($cookieName); if ($cookieData) { $request->params['_csrfToken'] = $cookieData; } if ($request->is('requested')) { return; } if ($request->is('get') && $cookieData === null) { $this->_setCookie($request, $response); } if ($request->is(['patch', 'put', 'post', 'delete'])) { $this->_validateToken($request); unset($request->data[$this->_config['field']]); } }",True,PHP,startup,CsrfComponent.php,https://github.com/cakephp/cakephp,cakephp,Mark Story,2015-11-25 22:11:16-05:00,"Only allow GET, HEAD, OPTIONS to not have CSRF tokens.
This covers cases where bad guys make up fake HTTP methods to trick CSRF
validation.
Update test cases to not muck about in $_SERVER too.",CWE-352,Cross-Site Request Forgery (CSRF),"The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",https://cwe.mitre.org/data/definitions/352.html,CVE-2015-8379,"public function Labyrinth($ip,$useragent){ global $config; mt_srand(Labyrinth::MakeSeed()); $this->dbhandle = new SQLiteDatabase($config['tracking_db']); $this->crawler_ip = sqlite_escape_string($ip); $this->crawler_useragent = sqlite_escape_string($useragent); $this->crawler_info = $this->dbhandle->query(""SELECT crawler_ip FROM crawlers WHERE crawler_ip='$this->ip' AND crawler_useragent='$this->useragent'""); }"
52,"public static function httpMethodProvider() { return [ ['PATCH'], ['PUT'], ['POST'], ['DELETE'] ]; }",True,PHP,httpMethodProvider,CsrfComponentTest.php,https://github.com/cakephp/cakephp,cakephp,Mark Story,2015-11-25 22:11:16-05:00,"Only allow GET, HEAD, OPTIONS to not have CSRF tokens.
This covers cases where bad guys make up fake HTTP methods to trick CSRF
validation.
Update test cases to not muck about in $_SERVER too.",CWE-352,Cross-Site Request Forgery (CSRF),"The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",https://cwe.mitre.org/data/definitions/352.html,CVE-2015-8379,"function _executeUpdateAct($output) { foreach($output->tables as $key => $val) { $table_list[] = '`'.$this->prefix.$val.'` as '.$key; } foreach($output->columns as $key => $val) { if(!isset($val['value'])) continue; $name = $val['name']; $value = $val['value']; if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value; else { if($output->column_type[$name]!='number') $value = ""'"".$this->addQuotes($value).""'""; else $value = (int)$value; $column_list[] = sprintf(""`%s` = %s"", $name, $value); } } $condition = $this->getCondition($output); $query = sprintf(""update %s set %s %s"", implode(',',$table_list), implode(',',$column_list), $condition); return $this->_query($query); }"
53,"public function testConfigurationCookieCreate() { $_SERVER['REQUEST_METHOD'] = 'GET'; $controller = $this->getMock('Cake\Controller\Controller', ['redirect']); $controller->request = new Request(['webroot' => '/dir/']); $controller->response = new Response(); $component = new CsrfComponent($this->registry, [ 'cookieName' => 'token', 'expiry' => '+1 hour', 'secure' => true, 'httpOnly' => true ]); $event = new Event('Controller.startup', $controller); $component->startup($event); $this->assertEmpty($controller->response->cookie('csrfToken')); $cookie = $controller->response->cookie('token'); $this->assertNotEmpty($cookie, 'Should set a token.'); $this->assertRegExp('/^[a-f0-9]+$/', $cookie['value'], 'Should look like a hash.'); $this->assertWithinRange((new Time('+1 hour'))->format('U'), $cookie['expire'], 1, 'session duration.'); $this->assertEquals('/dir/', $cookie['path'], 'session path.'); $this->assertTrue($cookie['secure'], 'cookie security flag missing'); $this->assertTrue($cookie['httpOnly'], 'cookie httpOnly flag missing'); }",True,PHP,testConfigurationCookieCreate,CsrfComponentTest.php,https://github.com/cakephp/cakephp,cakephp,Mark Story,2015-11-25 22:11:16-05:00,"Only allow GET, HEAD, OPTIONS to not have CSRF tokens.
This covers cases where bad guys make up fake HTTP methods to trick CSRF
validation.
Update test cases to not muck about in $_SERVER too.",CWE-352,Cross-Site Request Forgery (CSRF),"The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",https://cwe.mitre.org/data/definitions/352.html,CVE-2015-8379,"function _executeUpdateAct($output) { foreach ($output->tables as $key => $val) { $table_list[] = $this->prefix . $val; } foreach ($output->columns as $key => $val) { if (!isset($val['value'])) continue; $name = $val['name']; $value = $val['value']; if (strpos($name, '.') !== false && strpos($value, '.') !== false) $column_list[] = $name . ' = ' . $value; else { if ($output->column_type[$name] != 'number') $value = ""'"" . $this->addQuotes($value) . ""'""; else $value = (int)$value; $column_list[] = sprintf(""%s = %s"", $name, $value); } } $condition = $this->getCondition($output); $query = sprintf(""update %s set %s %s"", implode(',', $table_list), implode(',', $column_list), $condition); return $this->_query($query); }"
54,"public function testSettingCookie() { $_SERVER['REQUEST_METHOD'] = 'GET'; $controller = $this->getMock('Cake\Controller\Controller', ['redirect']); $controller->request = new Request(['webroot' => '/dir/']); $controller->response = new Response(); $event = new Event('Controller.startup', $controller); $this->component->startup($event); $cookie = $controller->response->cookie('csrfToken'); $this->assertNotEmpty($cookie, 'Should set a token.'); $this->assertRegExp('/^[a-f0-9]+$/', $cookie['value'], 'Should look like a hash.'); $this->assertEquals(0, $cookie['expire'], 'session duration.'); $this->assertEquals('/dir/', $cookie['path'], 'session path.'); $this->assertEquals($cookie['value'], $controller->request->params['_csrfToken']); }",True,PHP,testSettingCookie,CsrfComponentTest.php,https://github.com/cakephp/cakephp,cakephp,Mark Story,2015-11-25 22:11:16-05:00,"Only allow GET, HEAD, OPTIONS to not have CSRF tokens.
This covers cases where bad guys make up fake HTTP methods to trick CSRF
validation.
Update test cases to not muck about in $_SERVER too.",CWE-352,Cross-Site Request Forgery (CSRF),"The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",https://cwe.mitre.org/data/definitions/352.html,CVE-2015-8379,"function layout_navbar() { $t_logo_url = config_get('logo_url'); echo '
'; if (auth_is_user_authenticated()) { layout_navbar_button_bar(); layout_navbar_projects_menu(); layout_navbar_user_menu(); } echo '
'; echo '
'; echo '
'; echo '
'; }",True,PHP,layout_navbar,layout_api.php,https://github.com/mantisbt/mantisbt,mantisbt,Victor Boctor,2017-02-16 20:27:52-08:00,"Sanitize window title
The window title is not sanitized. That is not an issue when CSP is enable (default),
but if disabled, it can execute javascript that is set by a user who has access
to set configuration via Manage - Manage Configuration - Configuration Report page.
Fixes #22266",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2017-7222,"public function html() { switch( $this->type ) { case FILE_ADDED: $t_string = 'timeline_issue_file_added'; break; case FILE_DELETED: $t_string = 'timeline_issue_file_deleted'; break; default: throw new ServiceException( 'Unknown Event Type', ERROR_GENERIC ); } $t_bug_link = string_get_bug_view_link( $this->issue_id ); $t_html = $this->html_start( 'fa-file-o' ); $t_html .= '
'; }",True,PHP,html_operation_successful,html_api.php,https://github.com/mantisbt/mantisbt,mantisbt,Damien Regad,2016-06-11 02:01:33+02:00,"Fix XSS in custom fields management
Kacper Szurek (http://security.szurek.pl/) discovered an XSS
vulnerability in Custom fields management pages, caused by unescaped
output of 'return URL' GPC parameter. His report describes two ways to
exploit this issue:
1. using 'accesskey' inside hidden input field (see [1]) reflects XSS to
the administrator in manage_custom_field_edit_page.php when the
keyboard shortcut is actioned
2. using 'javascript:' URI scheme executes the code when the user clicks
the [Proceed] link on manage_custom_field_update.php after updating
a custom field
This commit fixes both attack vectors:
- properly escape the return URL prior to printing it on the hidden form
field
- let html_operation_successful() sanitize the URL before displaying
it, just like html_meta_redirect() does. In this case, if the
string contains an URI scheme, it will be replaced by 'index.php'
[1] http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html
Fixes #20956",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2016-5364,"public static function display() { $GLOBALS['PMA_Config']->checkGitRevision(); if (! $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT')) { $response = Response::getInstance(); $response->setRequestStatus(false); return; } $commit_hash = substr( $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH'), 0, 7 ); $commit_hash = 'get('PMA_VERSION_GIT_MESSAGE')) . '"">' . htmlspecialchars($commit_hash) . ''; if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTECOMMIT')) { $commit_hash = 'get('PMA_VERSION_GIT_COMMITHASH')) ) . '"" rel=""noopener noreferrer"" target=""_blank"">' . $commit_hash . ''; } $branch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH'); $isRemoteBranch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH'); if ($isRemoteBranch) { $branch = 'get('PMA_VERSION_GIT_BRANCH') ) . '"" rel=""noopener noreferrer"" target=""_blank"">' . htmlspecialchars($branch) . ''; } if ($branch !== false) { $branch = sprintf( __('%1$s from %2$s branch'), $commit_hash, $isRemoteBranch ? $branch : htmlspecialchars($branch) ); } else { $branch = $commit_hash . ' (' . __('no branch') . ')'; } $committer = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITTER'); $author = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_AUTHOR'); Core::printListItem( __('Git revision:') . ' ' . $branch . ', ' . sprintf( __('committed on %1$s by %2$s'), Util::localisedDate(strtotime($committer['date'])), '' . htmlspecialchars($committer['name']) . '' ) . ($author != $committer ? ', ' . sprintf( __('authored on %1$s by %2$s'), Util::localisedDate(strtotime($author['date'])), '' . htmlspecialchars($author['name']) . '' ) : ''), 'li_pma_version_git', null, null, null );"
79,"function current_user_get_bug_filter( $p_project_id = null ) { $f_filter_string = gpc_get_string( 'filter', '' ); $t_filter = ''; if( !is_blank( $f_filter_string ) ) { if( is_numeric( $f_filter_string ) ) { $t_token = token_get_value( TOKEN_FILTER ); if( null != $t_token ) { $t_filter = json_decode( $t_token, true ); } } else { $t_filter = json_decode( $f_filter_string, true ); } $t_filter = filter_ensure_valid_filter( $t_filter ); } else if( !filter_is_cookie_valid() ) { $t_filter = filter_get_default(); } else { $t_user_id = auth_get_current_user_id(); $t_filter = user_get_bug_filter( $t_user_id, $p_project_id ); } return $t_filter; }",True,PHP,current_user_get_bug_filter,current_user_api.php,https://github.com/mantisbt/mantisbt,mantisbt,Damien Regad,2018-02-02 12:14:42+01:00,"Fix PHP error - wrong argument type
Initialize $t_filter variable as array() instead of '' in
current_user_get_bug_filter(), to ensure its type is correct when
calling filter_ensure_valid_filter().
Fixes #23921",CWE-200,Exposure of Sensitive Information to an Unauthorized Actor,The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.,https://cwe.mitre.org/data/definitions/200.html,CVE-2018-6526,"private function _getDemoMessage() { $message = '' . __('phpMyAdmin Demo Server') . ': '; if (@file_exists('./revision-info.php')) { include './revision-info.php'; $message .= sprintf( __('Currently running Git revision %1$s from the %2$s branch.'), '' . htmlspecialchars($revision) . '', '' . htmlspecialchars($branch) . '' ); } else { $message .= __('Git information missing!'); } return Message::notice($message)->getDisplay(); }"
80,"public function html() { switch( $this->type ) { case FILE_ADDED: $t_string = 'timeline_issue_file_added'; break; case FILE_DELETED: $t_string = 'timeline_issue_file_deleted'; break; default: throw new ServiceException( 'Unknown Event Type', ERROR_GENERIC ); } $t_bug_link = string_get_bug_view_link( $this->issue_id ); $t_html = $this->html_start( 'fa-file-o' ); $t_html .= '
' . ($this->_tableType == 'recent' ?__('There are no recent tables.') :__('There are no favorite tables.')) . '
'; }",True,PHP,getIcon,RecentFavoriteTable.class.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Ann + J.M,2014-06-06 18:40:19+02:00,"Fix XSS in recent/favorite tables list feature
Signed-off-by: Ann + J.M ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-4348,"public static function extractColumnSpec($columnspec) { $first_bracket_pos = strpos($columnspec, '('); if ($first_bracket_pos) { $spec_in_brackets = chop( substr( $columnspec, $first_bracket_pos + 1, (strrpos($columnspec, ')') - $first_bracket_pos - 1) ) ); $type = strtolower(chop(substr($columnspec, 0, $first_bracket_pos))); } else { $type_parts = explode(' ',$columnspec); $type = strtolower($type_parts[0]); $spec_in_brackets = ''; } if ('enum' == $type || 'set' == $type) { $enum_set_values = self::parseEnumSetValues($columnspec, false); $printtype = $type . '(' . str_replace(""','"", ""', '"", $spec_in_brackets) . ')'; $binary = false; $unsigned = false; $zerofill = false; } else { $enum_set_values = array(); $printtype = strtolower($columnspec); if (preg_match('@binary@', $printtype) && ! preg_match('@binary[\(]@', $printtype) ) { $printtype = preg_replace('@binary@', '', $printtype); $binary = true; } else { $binary = false; } $printtype = preg_replace( '@zerofill@', '', $printtype, -1, $zerofill_cnt ); $zerofill = ($zerofill_cnt > 0); $printtype = preg_replace( '@unsigned@', '', $printtype, -1, $unsigned_cnt ); $unsigned = ($unsigned_cnt > 0); $printtype = trim($printtype); } $attribute = ' '; if ($binary) { $attribute = 'BINARY'; } if ($unsigned) { $attribute = 'UNSIGNED'; } if ($zerofill) { $attribute = 'UNSIGNED ZEROFILL'; } $can_contain_collation = false; if (! $binary && preg_match( ""@^(char|varchar|text|tinytext|mediumtext|longtext|set|enum)@"", $type ) ) { $can_contain_collation = true; } $displayed_type = htmlspecialchars($printtype); if (strlen($printtype) > $GLOBALS['cfg']['LimitChars']) { $displayed_type = ''; $displayed_type .= htmlspecialchars( $GLOBALS['PMA_String']->substr( $printtype, 0, $GLOBALS['cfg']['LimitChars'] ) ); $displayed_type .= ''; } return array( 'type' => $type, 'spec_in_brackets' => $spec_in_brackets, 'enum_set_values' => $enum_set_values, 'print_type' => $printtype, 'binary' => $binary, 'unsigned' => $unsigned, 'zerofill' => $zerofill, 'attribute' => $attribute, 'can_contain_collation' => $can_contain_collation, 'displayed_type' => $displayed_type ); }"
98,". htmlspecialchars($table['table']) . '`'; $html .= ''; } } } else { $html .= '
' . ($this->_tableType == 'recent' ?__('There are no recent tables.') :__('There are no favorite tables.')) . '
'; }",True,PHP,"].'"">`'.htmlspecialchars.'`.`'.htmlspecialchars",RecentFavoriteTable.class.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Ann + J.M,2014-06-19 12:52:52+02:00,"Fix XSS in PMA_RecentFavoriteTable::getHtmlList()
Signed-off-by: Ann + J.M ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-4348,"private function _getRowsNormal() { $odd_row = true; $html_output = ''; for ( $column_index = 0, $nb = count($this->_columnNames); $column_index < $nb; $column_index++ ) { $html_output .= '
'; }"
101,"public function getHtmlForControlButtons() { $ret = ''; $cfgRelation = PMA_getRelationsParam(); if ($cfgRelation['navwork']) { $db = $this->realParent()->real_name; $item = $this->real_name; $ret = '' . '' . PMA_Util::getImage('lightbulb_off.png', __('Hide')) . ''; } return $ret; }",True,PHP,getHtmlForControlButtons,Node_DatabaseChild.class.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Ann + J.M,2014-06-19 12:57:59+02:00,"Fix XSS in Hide navigation items feature
Signed-off-by: Ann + J.M ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-4349,"function PMA_getErrorReportForm() { $html = """"; $html .= ''; return $html; }"
102,"function PMA_TRI_getRowForList($trigger, $rowclass = '') { global $ajax_class, $url_query, $db, $table, $titles; $retval = ""
\n""; return $retval; }",True,PHP,PMA_TRI_getRowForList,rte_list.lib.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Marc Delisle,2014-07-11 06:39:20-04:00,"bug #4488 [security] XSS injection due to unescaped table name (triggers)
Signed-off-by: Marc Delisle ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-4955,"public static function factory($type) { include_once './libraries/gis/GIS_Geometry.class.php'; $type_lower = strtolower($type); if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes()) || ! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php') ) { return false; } if (include_once './libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php') { switch(strtoupper($type)) { case 'MULTIPOLYGON' : return PMA_GIS_Multipolygon::singleton(); case 'POLYGON' : return PMA_GIS_Polygon::singleton(); case 'MULTIPOINT' : return PMA_GIS_Multipoint::singleton(); case 'POINT' : return PMA_GIS_Point::singleton(); case 'MULTILINESTRING' : return PMA_GIS_Multilinestring::singleton(); case 'LINESTRING' : return PMA_GIS_Linestring::singleton(); case 'GEOMETRYCOLLECTION' : return PMA_GIS_Geometrycollection::singleton(); default : return false; } } else { return false; } }"
105,"function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $db, $myfield_md5, $tbl_storage_engine, $options_array ) { $html_output = '
'; }",True,PHP,_getRowsNormal,TableSearch.class.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Marc Delisle,2014-10-01 08:01:00-04:00,"[security] XSS with malicious ENUM values
Signed-off-by: Marc Delisle
Conflicts:
libraries/Util.class.php",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-7217,"$output .= htmlspecialchars($field->name); $output .= """"; } $output .= """"; $data = PMA_DBI_fetch_single_row($result); foreach ($data as $key => $value) { if ($value === null) { $value = 'NULL'; } else { $value = htmlspecialchars($value); } $output .= ""
"" . $value . ""
""; } $output .= """"; } else { $notice = __('MySQL returned an empty result set (i.e. zero rows).'); $output .= PMA_message::notice($notice)->getDisplay(); } } else { $output = ''; $message = PMA_message::error( sprintf( __('The following query has failed: ""%s""'), htmlspecialchars($query) ) . '
'; }",True,PHP,_getRowsNormal,TableSearch.class.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Marc Delisle,2014-10-01 08:09:12-04:00,"Bug 4544: additional fix for 4.2.x
Signed-off-by: Marc Delisle ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-7217,"function PMA_RTN_getRowForList($routine, $rowclass = '') { global $ajax_class, $url_query, $db, $titles; $sql_drop = sprintf('DROP %s IF EXISTS %s', $routine['ROUTINE_TYPE'], PMA_backquote($routine['SPECIFIC_NAME'])); $type_link = ""item_type={$routine['ROUTINE_TYPE']}""; $retval = ""
\n""; return $retval; }"
120,"function PMA_getErrorReportForm() { $html = """"; $html .= ''; return $html; }",True,PHP,PMA_getErrorReportForm,error_report.lib.php,https://github.com/phpmyadmin/phpmyadmin,phpmyadmin,Madhura Jayaratne,2014-11-20 06:08:49+05:18,"bug #4596 [security] XSS through exception stack
Signed-off-by: Madhura Jayaratne ",CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.,https://cwe.mitre.org/data/definitions/79.html,CVE-2014-8960,"function PMA_TRI_getRowForList($trigger, $rowclass = '') { global $ajax_class, $url_query, $db, $table, $titles; $retval = ""