GitStock

thorsten/phpmyfaq · Security

phpMyFAQ Stored Cross-site Scripting at FAQ News Content

GHSA ID
GHSA-6p68-36m6-392r
CVE ID
CVE-2024-28106
Severity
medium
Published
Updated
CVSS
4.3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v3
4.3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Description

Summary

By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.

PoC

  1. Edit a FAQ news, intercept the request and modify the news parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3e
  2. Browse to the particular news page and the XSS should pop up. image

Impact

This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub