CVE-2024-28106: phpmyfaq/phpmyfaq Stored Cross-site Scripting at FAQ News Content
Summary
CVE-2024-28106: phpMyFAQ Stored Cross-site Scripting at FAQ News Content. Affects phpmyfaq/phpmyfaq versions >= 3.2.5, < 3.2.6. Fixed in 3.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpmyfaq/phpmyfaq is a package available on Packagist that provides a frequently asked questions (FAQ) management system. It allows users to create and manage FAQ content, including news articles. The package is vulnerable to a stored cross-site scripting (XSS) attack in the FAQ news content. This means that an attacker can inject malicious JavaScript code into the news content, which will be executed when another user views the compromised news page.
Vulnerability Detail
The vulnerability arises from the lack of proper input sanitization in the news parameter of a POST request. By manipulating this parameter, an attacker can inject arbitrary JavaScript code. When a user accesses the compromised news page, the injected code will execute within the context of their phpMyFAQ session. This can lead to various malicious activities, such as stealing sensitive information, performing actions on behalf of the user, or spreading malware.
How To Fix
Minimum fixed version
3.2.6
This is the first release that contains the fix.
composer require phpmyfaq/phpmyfaq:3.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize and validate the news parameter before saving or displaying it. This can be done by removing or escaping any HTML or JavaScript tags and ensuring that only safe content is allowed. Here is an example of how to sanitize the news parameter in PHP:
$news = strip_tags($_POST['news']);
$news = htmlspecialchars($news);
// Save or display the sanitized news content
It is important to note that this workaround is not a permanent solution and should be replaced with the official fix as soon as possible.
Conclusion
The phpmyfaq/phpmyfaq package is vulnerable to a stored cross-site scripting (XSS) attack in the FAQ news content. This allows an attacker to inject and execute arbitrary JavaScript code within the context of another user's phpMyFAQ session. To mitigate this vulnerability, users should upgrade to version 3.2.6 or later and ensure proper input sanitization and validation for user-generated content. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
The vulnerability allows an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This can lead to various malicious activities, such as stealing sensitive information, performing actions on behalf of the user, or spreading malware.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your composer.lock file and provides real-time alerts for open-source vulnerabilities in your software.
Yes, the CVSS score for this vulnerability is 4.3, which indicates a moderate severity level.
The recommended mitigation is to upgrade to phpmyfaq/phpmyfaq version 3.2.6 or later. Additionally, implementing proper input sanitization and validation for user-generated content can help prevent similar vulnerabilities in the future.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-6p68-36m6-392r (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-6p68-36m6-392r/GHSA-6p68-36m6-392r.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
