phpMyFAQ Security Advisory

phpMyFAQ 2.x input sanitization errors (XSS)

Issued on:

2008-09-11

Software:

phpMyFAQ <= 2.0.8

Risk:

High

Platforms:

all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.

Description

phpMyFAQ relies on code similar to Popoon's externalinput.php to filter out potential XSS attacks on user-supplied input. This filter, and the original, fail to fully sanitize user data. In particular, this filter fails to protect against '/'s acting as spaces in both Microsoft Internet Explorer and Mozilla Firefox.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.0.8 which fixes these vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.0.8.

Credits

Vulnerability report and proof of concepts by Alexios Fakos. Thanks to Will Drewry for contacting the phpMyFAQ Team. The full advisory can be found here.