Security Advisory 2023-02-12

Multiple vulnerabilities in phpMyFAQ

Issued on:

2023-02-12

Software:

phpMyFAQ <= 3.1.10

Risk:

High

Platforms:

all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.10 and earlier. phpMyFAQ contains cross-site scripting (XSS), HTML injection vulnerabilities and a weak password check.

Description

phpMyFAQ does not implement sufficient checks to avoid

• a bypass to flood admin with FAQ proposals
• stored XSS in questions
• stored HTML injections
• weak passwords

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.11 which fixes these vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.11.

References

• Bypass
• XSS
• XSS
• HTML injection
• HTML injection
• Bypass
• XSS
• HTML injection
• Weak password
• HTML injection

Thanks

The phpMyFAQ team would like to thank @ahmedvienna and @josefjku for the responsible disclosure of this vulnerabilities.

Back to the security advisories overview