Listen to this Post
How the CVE Works
The vulnerability stems from an email validation bypass in PHP’s `FILTER_VALIDATE_EMAIL` filter. The function accepts email addresses with quoted local parts per RFC 5321, allowing special characters like angle brackets. An attacker submits a guest FAQ with an email such as "<script>alert(1)</script>"@evil.com. The application uses Filter::filterVar($data->email, FILTER_VALIDATE_EMAIL), which returns the malicious string as valid. This email is stored directly in the database via `phpmyfaq/src/phpMyFAQ/Faq.php` without any HTML sanitization. The administrative interface later renders this email in the FAQ editor template (faq.editor.twig). The template uses Twig’s `|raw` filter to output the email, bypassing auto-escaping. When an administrator navigates to `/admin/faq/edit/{id}/{lang}` to review the submission, the browser executes the injected JavaScript. The attack chain requires no authentication because guest FAQ submissions are enabled by default (records.allowNewFaqsForGuests=true) and FAQs require admin approval (records.defaultActivation=false). A CAPTCHA is present but can be solved manually, allowing a targeted attack to succeed.
Platform: phpMyFAQ
Version: 4.2.0-alpha
Vulnerability : Stored XSS
Severity: Critical
date: 2026-03-31
Prediction: 2026-04-14
What Undercode Say:
Simulate email validation bypass
php -r 'var_dump(filter_var("\"<script>alert(1)</script>\"@evil.com", FILTER_VALIDATE_EMAIL));'
Extract stored payload from database
mysql -u user -p database -e "SELECT email FROM faqdata WHERE id=1;"
Exploit:
1. Submit guest FAQ with email: `”“@evil.com`
2. Solve CAPTCHA manually if enabled.
- Wait for admin to edit the FAQ at
/admin/faq/edit/1/en.
Protection:
- Upgrade to patched version (≥ 4.2.1).
- Apply input sanitization before storing email addresses.
- Remove `|raw` filter from Twig template and use
|escape. - Disable guest FAQ submissions if not required.
Impact:
- Full admin account takeover via session cookie theft.
- Arbitrary admin actions (user creation, config changes).
- Potential server pivot from admin browser context.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
