Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS02cDY4LTM2bTYtMzkycs4AA6Ro

phpMyFAQ Stored Cross-site Scripting at FAQ News Content

Summary

By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.

PoC

  1. Edit a FAQ news, intercept the request and modify the news parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3e
  2. Browse to the particular news page and the XSS should pop up.
    image

Impact

This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session

Permalink: https://github.com/advisories/GHSA-6p68-36m6-392r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cDY4LTM2bTYtMzkycs4AA6Ro
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago


CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Identifiers: GHSA-6p68-36m6-392r, CVE-2024-28106
References: Repository: https://github.com/thorsten/phpMyFAQ
Blast Radius: 2.6

Affected Packages

packagist:phpmyfaq/phpmyfaq
Dependent packages: 0
Dependent repositories: 4
Downloads: 7 total
Affected Version Ranges: = 3.2.5
Fixed in: 3.2.6
All affected versions: 3.2.5
All unaffected versions: 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.6