CVE-2024-56199: phpMyFAQ Stored HTML Injection Vulnerability
Summary
CVE-2024-56199: phpMyFAQ Vulnerable to Stored HTML Injection at FAQ. Affects phpmyfaq/phpmyfaq versions >= 3.2.10, <= 4.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyFAQ is an open-source FAQ management system that allows users to create, manage, and display frequently asked questions. It is widely used for its ease of use and flexibility in managing FAQ content. However, due to insufficient validation of user inputs, phpMyFAQ is vulnerable to stored HTML injection, which can compromise the integrity of the FAQ content and user experience.
Vulnerability Detail
The vulnerability arises from a lack of proper validation and sanitization of user-provided content in new FAQ posts. Authenticated users can inject malicious HTML or JavaScript code into the FAQ entries, which can disrupt the user interface for other users. This can lead to Denial of Service, where legitimate users are unable to access the FAQ page, and can also be exploited for phishing or defacement attacks. The vulnerability affects versions from 3.2.10 to 4.0.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the FAQ editing features to trusted users only until the package is updated. Additionally, consider implementing input validation and sanitization measures in your application to mitigate the risk of HTML injection.
Conclusion
The stored HTML injection vulnerability in phpMyFAQ poses a significant risk to users by allowing malicious content to disrupt the FAQ interface. It is crucial to update to the latest version to mitigate this risk and ensure the safety of your application.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
The vulnerability allows authenticated users to inject malicious HTML or JavaScript into FAQ entries, affecting the display and functionality of the FAQ page.
Any user of phpMyFAQ versions 3.2.10 to 4.0.1 is at risk, particularly those who can create or edit FAQ entries.
The impacts include Denial of Service for legitimate users, disruption of the user experience, and potential exploitation for phishing attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 5.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
