GitHub Security Advisory: GHSA-jv8r-hv7q-p6vc
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.14, < 4.0.16
Patched in: 4.0.16

Summary: phpMyFAQ has Stored XSS in user list via admin-managed display_name

Details:
### Summary
A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `&lt;img ...&gt;`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.

### Details
Root cause is the following chain:
- **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `&lt;img ...&gt;`).
- **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (“for backward compatibility”).
- **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`:
  - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`)

As a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.

Note: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field.

### PoC (minimal reproduction)
**Preconditions / configuration**
- Registration enabled (`security.enableRegistration = true`).
- Attacker does not need admin privileges.
- Admin must view the admin user list page.

**Steps**
1. As an unauthenticated user, open the registration page and create a new account.
2. Set the **display name / real name** field to the following entity-encoded payload:
   - `&lt;img src=x onerror=alert(1)&gt;`
3. Complete registration.
4. As an administrator, open the admin user list (example):
   - `http://127.0.0.1:8080/admin/user/list`
5. Observe JavaScript execution in the admin’s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `<img>` element.

### Impact
Stored XSS in the admin context can enable:
- admin session compromise (depending on cookie flags),
- CSRF token exfiltration and privileged admin actions,
- UI redress/phishing within the admin panel.

### Evidence (what I observed)
- Stored DB value (entities):
  `&lt;img src=x onerror=alert(1)&gt;`
- Rendered HTML in admin user list:
  `<img src="x" onerror="alert(1)">`

### Affected versions
**Confirmed by code inspection**
- 4.0.14
- 4.0.15
  - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`.

**Confirmed by live reproduction**
- 4.1.0-RC (tested on current source checkout)

### Environment (tested)
- Host OS: macOS 15.6.1 (24G90)
- Web container OS: Debian GNU/Linux 12 (bookworm)
- PHP: 8.4.5RC1
- DB: MariaDB 11.6.2
- phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848

### Contact / Credit
- Contact: jeongwoolee340@gmail.com