Skip to content

phpMyFAQ Stored Cross-site Scripting at FAQ News Content

Moderate severity GitHub Reviewed Published Mar 25, 2024 in thorsten/phpMyFAQ • Updated Mar 25, 2024

Package

composer phpmyfaq/phpmyfaq (Composer)

Affected versions

= 3.2.5

Patched versions

3.2.6

Description

Summary

By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.

PoC

  1. Edit a FAQ news, intercept the request and modify the news parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3e
  2. Browse to the particular news page and the XSS should pop up.
    image

Impact

This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session

References

@thorsten thorsten published to thorsten/phpMyFAQ Mar 25, 2024
Published by the National Vulnerability Database Mar 25, 2024
Published to the GitHub Advisory Database Mar 25, 2024
Reviewed Mar 25, 2024
Last updated Mar 25, 2024

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CVE ID

CVE-2024-28106

GHSA ID

GHSA-6p68-36m6-392r

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.