Stored XSS in phpMyFAQ Prior to Version 4.1.8

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ versions before 4.1.8. The issue occurs in the FAQ rendering process where the convertOldInternalLinks() function calls html_entity_decode() on sanitized FAQ content. This reverses the entity-encoding protection applied during sanitization, reactivating attacker-controlled XSS payloads. Authenticated users with FAQ editing privileges can inject malicious JavaScript into FAQ answers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect phpMyFAQ installations for versions 4.0.8 through 4.1.7. Check FaqHelper.php for the convertOldInternalLinks() function and verify if html_entity_decode() is called on sanitized FAQ content. Review FAQ editing privileges for unauthorized users.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, impersonate users, redirect visitors to malicious sites, or deface FAQ content. All users viewing affected FAQ pages would have their browsers execute the injected JavaScript payloads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to inject malicious JavaScript into FAQ content, which executes in users' browsers. This could lead to unauthorized data access, session hijacking, or defacement, potentially violating GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive user information or enabling unauthorized actions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.8 or later immediately. Remove the html_entity_decode() call in FaqHelper::convertOldInternalLinks(). Restrict FAQ editing privileges to trusted users only. Monitor FAQ content for suspicious JavaScript payloads.

Useful 0 Not Useful 0