Kurz gesagt
- CVE-2024-28106 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in phpmyfaq/phpmyfaq, phpmyfaq (phpmyfaq).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.54%, höher als bei 45.6% aller Schwachstellen.
- Abhilfe: auf 3.2.6 oder neuer aktualisieren.
Description
Summary
By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.
PoC
- Edit a FAQ news, intercept the request and modify the
news parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3e
- Browse to the particular news page and the XSS should pop up.
Impact
This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session
NVD description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free