GHSA-6p68-36m6-392rmedium4.3
phpMyFAQ Stored Cross-site Scripting at FAQ News Content
The advisory, in context
Summary
By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.
PoC
- Edit a FAQ news, intercept the request and modify the
newsparameter in the POST body with the following payload:%3cscript%3ealert('xssContent')%3c%2fscript%3e - Browse to the particular news page and the XSS should pop up.
Impact
This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
phpmyfaq/phpmyfaq Packagist
Ecosystem versions
From 3.2.5 before 3.2.6
Fixed in 3.2.6
1 explicitly affected versions
3.2.5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.2.5"
},
{
"fixed": "3.2.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.2.5"
]
}