Listen to this Post
How the mentioned CVE works:
The vulnerability stems from improper handling of user-supplied HTML entities in the display_name field during registration. When an attacker registers with a malicious display name containing entity-encoded payloads (e.g., <img src=x onerror=alert(1)>), this input is stored in the database. In affected versions, the server-side code in `UserData.php` decodes these entities using `html_entity_decode()` for backward compatibility. Subsequently, the admin user list template (users.twig) renders the decoded value without escaping via the `|raw` filter. This allows the payload to be executed as active HTML/JavaScript when an administrator views the user list, leading to stored cross-site scripting in the admin context. The attack chain requires registration to be enabled and admin access to the user list, but no prior authentication for the attacker. The flaw is distinct from prior email field issues and affects multiple versions due to the consistent use of unsafe decoding and rendering practices.
dailycve form:
Platform: phpMyFAQ
Version: 4.0.14, 4.0.15, 4.1.0-RC
Vulnerability: Stored XSS
Severity: Critical
Date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics
- Code inspection: `phpmyfaq/src/phpMyFAQ/User/UserData.php` contains
html_entity_decode($displayName). - Template review: `phpmyfaq/assets/templates/admin/user/users.twig` uses
{{ user.display_name|raw }}. - Bash command to check versions:
grep -r "html_entity_decode" phpMyFAQ/src/. - Bash command to test registration: `curl -X POST -d “display_name=
” http://target/register`.
How Exploit:
- Enable registration if disabled.
- Register with malicious display name.
- Admin views user list.
- JavaScript executes automatically.
Protection from this CVE
- Avoid `html_entity_decode` on user input.
- Replace `|raw` with escaping filters.
- Implement strict input sanitization.
Impact:
- Admin session compromise.
- CSRF token exfiltration.
- Privileged admin actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
