GHSA-7m8g-fprr-47fx

Опубликовано: 05 фев. 2024

Источник: github

Github: Прошло ревью

CVSS3: 6.5

Описание

phpMyFAQ vulnerable to stored XSS on attachments filename

Summary

Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)

Details

On that snippet code of rendering the file attachments from user tables

<?php foreach ($crumbs as $item) : ?> <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>"> <td><?= $item->id ?></td> <td><?= $item->filename ?></td> <td><?= $item->record_lang ?></td> <td><?= Utils::formatBytes($item->filesize) ?></td> <td><?= $item->mime_type ?></td> <td>

The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of Strings::htmlentities on use phpMyFAQ\Strings;

<td><?= Strings::htmlentities($item->filename); ?></td> <td><?= Strings::htmlentities($item->record_lang); ?></td> <td><?= Utils::formatBytes($item->filesize) ?></td> <td><?= Strings::htmlentities($item->mime_type); ?></td>

Propose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827

PoC

An attacker with permission will upload the attachments image on http://{base_url}/admin/?action=editentry
On endpoint of ajax upload image POST /admin/index.php?action=ajax&ajax=att&ajaxaction=upload
Change the originally name file on parameters filename to a XSS payload
The XSS will trigger on attachment pages /admin/?action=attachments

Trigger XSS
Payload XSS

Impact

This vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table faqattachment columns filename.

The XSS payload could be rendering on page that listing the file on tables, and impact to others user that on the hierarchy.

The payload XSS have several attack scenario such like

Stealing the cookies (isn’t possible since HttpOnly)
Crashing the application with a looping javascript payload

Ссылки

Пакеты

Наименование

phpmyfaq/phpmyfaq

composer

Затронутые версииВерсия исправления

< 3.2.5

3.2.5

EPSS

Процентиль: 85%

0.02404

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2024-24574

Дефекты

CWE-79

CWE-80

Связанные уязвимости

CVE-2024-24574

CVSS3: 6.5

nvd

около 2 лет назад

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.

EPSS

Процентиль: 85%

0.02404

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2024-24574

Дефекты

CWE-79

CWE-80