phpMyFAQ phpMyFAQ The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.0.
phpMyFAQ relies on code similar to Popoon's externalinput.php to filter out potential XSS attacks on user-supplied input. This filter, and the original, fail to fully sanitize user data. In particular, this filter fails to protect against '/'s acting as spaces in both Microsoft Internet Explorer and Mozilla Firefox.
The phpMyFAQ Team has released a new phpMyFAQ version 2.0.8 which fixes these vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
There's no workaround except installing phpMyFAQ 2.0.8.
Vulnerability report and proof of concepts by Alexios Fakos. Thanks to Will Drewry for contacting the phpMyFAQ Team. The full advisory can be found here.