Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Vulnerability

Overview

CVE-2023-1885 is a stored cross-site scripting (XSS) vulnerability in the phpMyFAQ open-source FAQ application. Versions prior to 3.1.12 fail to properly sanitize category names when displaying them in the administration interface. The root cause is the missing conversion of HTML entities in category name output, as shown in the fix commit that adds a call to Strings::htmlentities() [3].

Exploitation

Vector

An authenticated user with the ability to create or edit categories (typically an administrator) can inject arbitrary JavaScript or HTML into the category name field. This stored payload is then rendered unsanitized on category management pages, executing in the browsers of other admin users who view or manage those categories [1][4]. No additional authentication is required on the victim's part beyond being an authenticated admin.

Impact

Successful exploitation enables an attacker to execute arbitrary scripts in the context of an administrator's session. This could lead to session hijacking, defacement of admin pages, theft of sensitive data, or further privilege escalation within the application. The stored nature of the XSS means the payload persists until cleaned, potentially affecting multiple users over time.

Mitigation

The vulnerability is fixed in phpMyFAQ version 3.1.12 [2]. Users are strongly advised to upgrade immediately. The fix explicitly applies Strings::htmlentities() to category names before output, preventing HTML injection [3]. No workarounds are documented.