CVE-2023-5867: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-10-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.edit.php, phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php
Commit date: 2023-10-04 07:34:59 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/record.edit.php b/phpmyfaq/admin/record.edit.php
index c6ab7f4f43b..05ca9089a79 100644
--- a/phpmyfaq/admin/record.edit.php
+++ b/phpmyfaq/admin/record.edit.php
@@ -482,11 +482,11 @@ if (
                                                 );
                                                 foreach ($attList as $att) {
                                                     printf(
                                                         '<li><a href="../%s">%s</a> ',
                                                         $att->buildUrl(),
-                                                        $att->getFilename()
+                                                        Strings::htmlentities($att->getFilename())
                                                     );
                                                     if ($user->perm->hasPermission($currentUserId, 'delattachment')) {
                                                         printf(
                                                             '<a class="badge bg-danger" href="?action=delatt&amp;record_id=%d&amp;id=%d&amp;lang=%s"><i aria-hidden="true" class="fa fa-trash"></i></a>',
                                                             $faqData['id'],
diff --git a/phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php
index 146915fb2eb..a3fd925539d 100644
--- a/phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php
+++ b/phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php
@@ -16,10 +16,11 @@
  */
 
 namespace phpMyFAQ\Helper;
 
 use phpMyFAQ\Attachment\AttachmentAbstract;
+use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
 
 /**
  * Class AttachmentHelper
  * @package phpMyFAQ\Helper
@@ -43,11 +44,11 @@ class AttachmentHelper
         foreach ($attachmentList as $attachment) {
             $html .= sprintf(
                 '<li><i class="fa fa-%s" aria-hidden="true"></i> <a href="%s">%s</a></li>',
                 $this->mapMimeTypeToIcon($attachment->getMimeType()),
                 $attachment->buildUrl(),
-                $attachment->getFilename()
+                Strings::htmlentities($attachment->getFilename())
             );
         }
 
         return $html . '</ul>';
     }

Vulnerable code:                                                         $att->getFilename()
                $attachment->getFilename()
Fixed code:                                                         Strings::htmlentities($att->getFilename())
use phpMyFAQ\Strings;
                Strings::htmlentities($attachment->getFilename())