CVE-2024-27300: phpMyFAQ stored Cross-site Scripting at user email
The email field in phpMyFAQ’s user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP’s FILTER_VALIDATE_EMAIL function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user’s phpMyFAQ session.
References
- github.com/advisories/GHSA-q7g6-xfh2-vhpx
- github.com/thorsten/phpMyFAQ
- github.com/thorsten/phpMyFAQ/commit/09336b0ff0e0a04aa0c97c5975651af4769d2459
- github.com/thorsten/phpMyFAQ/commit/de90315c9bd4ead5fe6ba5586f6b016843aa8209
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-q7g6-xfh2-vhpx
- nvd.nist.gov/vuln/detail/CVE-2024-27300
Code Behaviors & Features
Detect and mitigate CVE-2024-27300 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →