CVE-2024-27300 (published 2024-03-25T19:15Z)

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-03-01 18:41:57+01:00
msg: fix: added missing conversion to HTML entities
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -573,8 +573,8 @@ if (
                 <tr class="row_user_id_<?= $user->getUserId() ?>">
                     <td><?= Strings::htmlentities($user->getUserData('display_name')) ?></td>
                     <td>
-                        <a href="mailto:<?= $user->getUserData('email') ?>">
-                            <?= $user->getUserData('email') ?>
+                        <a href="mailto:<?= Strings::htmlentities($user->getUserData('email')) ?>">
+                            <?= Strings::htmlentities($user->getUserData('email')) ?>
                         </a>
                     </td>
                     <td><?= Strings::htmlentities($user->getLogin()) ?></td>

programming_language: PHP
filename: ucp.php
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,7 @@ if ($user->isLoggedIn()) {
             'msgRealName' => Translation::get('ad_user_name'),
             'realname' => Strings::htmlentities($user->getUserData('display_name')),
             'msgEmail' => Translation::get('msgNewContentMail'),
-            'email' => $user->getUserData('email'),
+            'email' => Strings::htmlentities($user->getUserData('email')),
             'msgIsVisible' => Translation::get('ad_user_data_is_visible'),
             'checked' => (int)$user->getUserData('is_visible') === 1 ? 'checked' : '',
             'msgPassword' => Translation::get('ad_auth_passwd'),

programming_language: PHP
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-03-01 18:41:57+01:00
msg: fix: added missing conversion to HTML entities
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -572,8 +572,8 @@ if (
                     <td><?= Strings::htmlentities($user->getUserData('display_name')) ?></td>
                     <td><?= Strings::htmlentities($user->getLogin()) ?></td>
                     <td>
-                        <a href="mailto:<?= $user->getUserData('email') ?>">
-                            <?= $user->getUserData('email') ?>
+                        <a href="mailto:<?= Strings::htmlentities($user->getUserData('email')) ?>">
+                            <?= Strings::htmlentities($user->getUserData('email')) ?>
                         </a>
                     </td>
                     <td>

programming_language: PHP
filename: ucp.php
change_type: ModificationType.MODIFY
diff: @@ -75,7 +75,7 @@ if ($user->isLoggedIn()) {
             'msgRealName' => Translation::get('ad_user_name'),
             'realname' => Strings::htmlentities($user->getUserData('display_name')),
             'msgEmail' => Translation::get('msgNewContentMail'),
-            'email' => $user->getUserData('email'),
+            'email' => Strings::htmlentities($user->getUserData('email')),
             'msgIsVisible' => Translation::get('ad_user_data_is_visible'),
             'checked' => (int)$user->getUserData('is_visible') === 1 ? 'checked' : '',
             'msgPassword' => Translation::get('ad_auth_passwd'),

programming_language: PHP