Vulnerability: inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
Vulnerability ID: CVE-2017-7579
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/thorsten/phpMyFAQ
Published: 2017-04-07
File: phpmyfaq/inc/PMF/Faq.php
Commit message: Added missing sanitizing
Commit author: Thorsten Rinne

Vulnerable version (before fix):
 public function getTopTenData($count = PMF_NUMBER_RECORDS_TOPTEN, $categoryId =                 }                  $data['visits'] = (int)$row->visits;                 $data['question'] = $row->question;                 $data['date'] = $row->updated;                 $data['last_visit'] = $row->last_visit;  public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu                 }                  $data['date'] = $row->updated;                 $data['question'] = $row->question;                 $data['answer'] = $row->content;                 $data['visits'] = $row->visits;  public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu                     $row->lang                 );                 $oLink = new PMF_Link($url, $this->_config);                 $oLink->itemTitle = $row->question;                 $oLink->tooltip = $title;                 $data['url'] = $oLink->toString(); 

Fixed version (after fix):
 public function getTopTenData($count = PMF_NUMBER_RECORDS_TOPTEN, $categoryId =                 }                  $data['visits'] = (int)$row->visits;                 $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);                 $data['date'] = $row->updated;                 $data['last_visit'] = $row->last_visit;  public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu                 }                  $data['date'] = $row->updated;                 $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);                 $data['answer'] = $row->content;                 $data['visits'] = $row->visits;  public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu                     $row->lang                 );                 $oLink = new PMF_Link($url, $this->_config);                 $oLink->itemTitle = $title;                 $oLink->tooltip = $title;                 $data['url'] = $oLink->toString(); 

Patch:
patch: @@ -2137,7 +2137,7 @@ public function getTopTenData($count = PMF_NUMBER_RECORDS_TOPTEN, $categoryId =
                 }
 
                 $data['visits'] = (int)$row->visits;
-                $data['question'] = $row->question;
+                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                 $data['date'] = $row->updated;
                 $data['last_visit'] = $row->last_visit;
 
@@ -2246,7 +2246,7 @@ public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu
                 }
 
                 $data['date'] = $row->updated;
-                $data['question'] = $row->question;
+                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                 $data['answer'] = $row->content;
                 $data['visits'] = $row->visits;
 
@@ -2260,7 +2260,7 @@ public function getLatestData($count = PMF_NUMBER_RECORDS_LATEST, $language = nu
                     $row->lang
                 );
                 $oLink = new PMF_Link($url, $this->_config);
-                $oLink->itemTitle = $row->question;
+                $oLink->itemTitle = $title;
                 $oLink->tooltip = $title;
                 $data['url'] = $oLink->toString();
path: phpmyfaq/inc/PMF/Faq.php