Security Fix for Cross-site Scripting (XSS) - huntr.dev

[huntr-helper]

https://huntr.dev/users/Asjidkalam has fixed the Cross-site Scripting (XSS) vulnerability 🔨. Asjidkalam has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue | #190
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/packagist/opencart-overclocked/1/README.md

User Comments:

📊 Metadata *

Fixed Cross Site Scripting.

Bounty URL: https://www.huntr.dev/bounties/1-packagist-opencart-overclocked

⚙️ Description *

Reflected Cross-Site Scripting (XSS) may allow an attacker to execute JavaScript code in the context of the victim's browser. This may lead to unauthorized actions being performed, unauthorized access to data, stealing of session information, denial of service, etc. An attacker needs to coerce a user into visiting a link with the XSS payload to be properly exploited against a victim.

💻 Technical Description *

The following code shows that the $_GET['token'] variable is reflected in the victim's browser without any input validation, leading to reflected XSS:

OpenCart-Overclocked/upload/admin/view/template/extension/openbay.tpl

Line 95 in d145e4c

var token = "<?php echo $_GET['token']; ?>";

To fix the issue, PHP's htmlspecialchars() is used to convert special characters to HTML entities.

Reference: https://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php

🐛 Proof of Concept (PoC) *

Payload: "; alert(1); //
Use this payload with the GET parameter token to trigger the XSS

🔥 Proof of Fix (PoF) *

After using the htmlspecialchars, all payloads are sanitized to prevent triggering XSS.

👍 User Acceptance Testing (UAT)

Just wrapped the echo command with the htmlspecialchars, no breaking changes introduced. :)