Security Advisory 2008-09-11

phpMyFAQ 2.x input sanitization errors (XSS)

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.0.

phpMyFAQ relies on code similar to Popoon's externalinput.php to filter out potential XSS

attacks on user-supplied input. This filter, and the original, fail to fully sanitize user data.

In particular, this filter fails to protect against '/'s acting as spaces in both Microsoft

Internet Explorer and Mozilla Firefox.

The phpMyFAQ Team has released a new phpMyFAQ version 2.0.8 which fixes these vulnerabilities.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

There's no workaround except installing phpMyFAQ 2.0.8.

Vulnerability report and proof of concepts by Alexios Fakos. Thanks to Will Drewry for

contacting the phpMyFAQ Team. The full advisory can be found