GitHub Advisoryadvisory · Packagist

GHSA-6p68-36m6-392r phpMyFAQ Stored Cross-site Scripting at FAQ News Content

MEDIUM Published 2024-03-25 Modified 2024-03-25 Official page ↗
Aliases
CVE-2024-28106
Ecosystem
Packagist
Packages
phpmyfaq/phpmyfaq
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2024-03-25

Affected packages

• Packagist phpmyfaq/phpmyfaq: >= 3.2.5, < 3.2.6 → fixed in 3.2.6

Description

Summary By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. PoC 1. Edit a FAQ news, intercept the request and modify the `news` parameter in the POST body with the following payload: `%3cscript%3ealert('xssContent')%3c%2fscript%3e` 2. Browse to the particular news page and the XSS should pop up. Impact This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session

Related

Alias · CVE (1)

  • CVE-2024-28106 phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References