CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
29.4%
Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)
On that snippet code of rendering the file attachments from user tables
<?php foreach ($crumbs as $item) : ?>
<tr>
<td><?= $item->id ?></td>
<td><?= $item->filename ?></td>
<td><?= $item->record_lang ?></td>
<td><?= Utils::formatBytes($item->filesize) ?></td>
<td><?= $item->mime_type ?></td>
<td>
The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of Strings::htmlentities
on use phpMyFAQ\Strings;
<td><?= Strings::htmlentities($item->filename); ?></td>
<td><?= Strings::htmlentities($item->record_lang); ?></td>
<td><?= Utils::formatBytes($item->filesize) ?></td>
<td><?= Strings::htmlentities($item->mime_type); ?></td>
Propose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827
Trigger XSS
Payload XSS
<img width=β1000β alt=βimageβ src=βhttps://user-images.githubusercontent.com/37658579/301022571-d6cdd166-b1f9-4062-87c5-c8bbb308cd5d.pngβ>
This vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table faqattachment
columns filename.
The XSS payload could be rendering on page that listing the file on tables, and impact to others user that on the hierarchy.
The payload XSS have several attack scenario such like
github.com/advisories/GHSA-7m8g-fprr-47fx
github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
github.com/thorsten/phpMyFAQ/pull/2827
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
nvd.nist.gov/vuln/detail/CVE-2024-24574
www.phpmyfaq.de/security/advisory-2024-02-05
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
29.4%