Security Advisory 2023-02-12
Multiple vulnerabilities in phpMyFAQ
- Issued on:
- 2023-02-12
- Software:
- phpMyFAQ <= 3.1.10
- Risk:
- High
- Platforms:
- all
The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.10 and
earlier. phpMyFAQ contains cross-site scripting (XSS), HTML injection vulnerabilities and a weak password check.
Description
phpMyFAQ does not implement sufficient checks to avoid
- a bypass to flood admin with FAQ proposals
- stored XSS in questions
- stored HTML injections
- weak passwords
Solution
The phpMyFAQ Team has released the new phpMyFAQ version 3.1.11 which fixes these vulnerabilities. All
users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
Workaround
There's no workaround except installing phpMyFAQ 3.1.11.
References
Thanks
The phpMyFAQ team would like to thank @ahmedvienna and @josefjku for the responsible disclosure of this
vulnerabilities.