4) XSS in help.php:

http://<VULNERABLE
SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script>

Based on Jason's fix.

Also include a nasty i18n bugfix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3665 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/src/help.php b/src/help.php
index e9b3c3167ba6cf5034eb859f8e479c12f5b2be59..88b92f197c116fcca25400aa117bf16e730957e4 100644 (file)
--- a/src/help.php
+++ b/src/help.php
@@ -41,6 +41,7 @@ $helpdir[8] = 'FAQ.hlp';
  */
 
 function get_info($doc, $pos) {
+
     for ($n=$pos; $n < count($doc); $n++) {
         if (trim(strtolower($doc[$n])) == '<chapter>'
             || trim(strtolower($doc[$n])) == '<section>') {
@@ -70,18 +71,19 @@ function get_info($doc, $pos) {
             }
             if (isset($ary)) {
                 $ary[3] = $n;
-                return $ary;
             } else {
-                $ary[0] = 'ERROR: Help files are not in the right format!';
-                $ary[1] = 'ERROR: Help files are not in the right format!';
-                $ary[2] = 'ERROR: Help files are not in the right format!';
-                return $ary;
+                $ary[0] = _("ERROR: Help files are not in the right format!");
+                $ary[1] = $ary[0];
+                $ary[2] = $ary[0];
             }
+           return( $ary );
         }
     }
-    $ary[0] = 'ERROR: Help files are not in the right format!';
-    $ary[1] = 'ERROR: Help files are not in the right format!';
-    return $ary;
+    
+    $ary[0] = _("ERROR: Help files are not in the right format!");
+    $ary[1] = $ary[0];
+
+    return( $ary );
 }
 
 /**************[ END HELP FUNCTIONS ]******************/
@@ -163,9 +165,13 @@ if ($help_exists == true) {
         $chapter = 3;
     } else if ($context == 'search'){
         $chapter = 8;
+    } else if ( isset( $_GET['chapter'] ) ) {
+       $chapter = intval( $_GET['chapter']);
+    } else {
+       $chapter = 0;
     }
 
-    if (!isset($chapter)) {
+    if ( $chapter == 0 || !isset( $helpdir[$chapter] ) ) {
         echo html_tag( 'table', '', 'center', '', 'cellpadding="0" cellspacing="0" border="0"' );
                    html_tag( 'tr' ) .
                         html_tag( 'td' ) .