Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Vulnerability

Description A stored cross-site scripting (XSS) vulnerability exists in GitHub repository thorsten/phpmyfaq prior to version 3.1.17. The root cause is insufficient sanitization of user-supplied input when editing tags; the application failed to escape HTML entities such as <, >, ", ', and & before rendering them in the Document Object Model (DOM) using $(...).html(). This allows an attacker to inject arbitrary JavaScript that is executed in the context of a victim's browser session [1][3].

Exploitation

An attacker with the ability to submit or modify tags (for example, authenticated users with permission to manage FAQ tags) can craft a malicious tag value containing HTML/JavaScript payloads. The injected script is stored on the server and later served to any user who views the affected tag. No special network position is required beyond access to the tag editing interface; the vulnerability is triggered when the browser processes the unsanitized input. The commit that fixes the issue adds a missing escape() call to convert HTML special characters before inserting user-controlled data into the DOM [3][4].

Impact

A successful attack can lead to session hijacking, credential theft, or other actions that a malicious script can perform on behalf of the victim, such as modifying FAQ content or executing administrative operations if the victim has elevated privileges. The stored nature of this XSS increases its severity, as the payload persists until the FAQ entry is removed or the tag is corrected [2].

Mitigation

The vulnerability is fixed in phpMyFAQ version 3.1.17. Users should upgrade immediately. No workarounds have been publicly documented, but restricting tag editing privileges to trusted users can reduce the risk. The fix, visible in commit 1037a8f, ensures user input passed through the input.val().replace(/\//g, '/') path is also escaped via the client-side escape() function [3][4].