Description
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpmyfaq | < 4.1.2 | 4.1.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | < 4.1.2 | 4.1.2 | GHSA-f5p7-2c9q-8896 |
| Packagist | thorsten/phpmyfaq | < 4.1.2 | 4.1.2 | GHSA-f5p7-2c9q-8896 |
References
- GitHub Security Advisory (GHSA-f5p7-2c9q-8896) vendor-advisory
- VulnCheck Advisory: phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass third-party-advisory