CVE-2024-27300: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/user.php, phpmyfaq/ucp.php
Commit date: 2024-03-01 18:44:41 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/user.php b/phpmyfaq/admin/user.php
index ef30173645..24579ba83e 100755
--- a/phpmyfaq/admin/user.php
+++ b/phpmyfaq/admin/user.php
@@ -570,12 +570,12 @@ if (
                         <i class="fa <?= $user->getUserData('is_visible') ? 'fa-user' : 'fa-user-o' ?>"></i>
                     </td>
                     <td><?= Strings::htmlentities($user->getUserData('display_name')) ?></td>
                     <td><?= Strings::htmlentities($user->getLogin()) ?></td>
                     <td>
-                        <a href="mailto:<?= $user->getUserData('email') ?>">
-                            <?= $user->getUserData('email') ?>
+                        <a href="mailto:<?= Strings::htmlentities($user->getUserData('email')) ?>">
+                            <?= Strings::htmlentities($user->getUserData('email')) ?>
                         </a>
                     </td>
                     <td>
                         <a href="?action=user&amp;user_id=<?= $user->getUserData('user_id') ?>"
                            class="btn btn-sm btn-info">
diff --git a/phpmyfaq/ucp.php b/phpmyfaq/ucp.php
index 6a1d7ecab9..2cc815b2b6 100644
--- a/phpmyfaq/ucp.php
+++ b/phpmyfaq/ucp.php
@@ -73,11 +73,11 @@ if ($user->isLoggedIn()) {
             'lang' => $Language->getLanguage(),
             'readonly' => $user->isLocalUser() ? '' : 'readonly disabled',
             'msgRealName' => Translation::get('ad_user_name'),
             'realname' => Strings::htmlentities($user->getUserData('display_name')),
             'msgEmail' => Translation::get('msgNewContentMail'),
-            'email' => $user->getUserData('email'),
+            'email' => Strings::htmlentities($user->getUserData('email')),
             'msgIsVisible' => Translation::get('ad_user_data_is_visible'),
             'checked' => (int)$user->getUserData('is_visible') === 1 ? 'checked' : '',
             'msgPassword' => Translation::get('ad_auth_passwd'),
             'msgConfirm' => Translation::get('ad_user_confirm'),
             'msgSave' => Translation::get('msgSave'),

Vulnerable code:                         <a href="mailto:<?= $user->getUserData('email') ?>">
                            <?= $user->getUserData('email') ?>
            'email' => $user->getUserData('email'),
Fixed code:                         <a href="mailto:<?= Strings::htmlentities($user->getUserData('email')) ?>">
                            <?= Strings::htmlentities($user->getUserData('email')) ?>
            'email' => Strings::htmlentities($user->getUserData('email')),