Stored XSS in phpMyFAQ via SVG Sanitization Bypass

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ versions 4.2.0-alpha up to but not including 4.2.0-beta. It exists in the SvgSanitizer component where malicious SVG files with custom XML DTD entities bypass sanitization. Attackers with FAQ_EDIT permissions can upload such SVGs, which when clicked by victims, execute JavaScript code to hijack admin sessions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect phpMyFAQ installations for versions between 4.2.0-alpha and 4.2.0-beta. Check for uploaded SVG files containing XML DTD entities or JavaScript in anchor href attributes. Review server logs for suspicious SVG uploads by users with FAQ_EDIT permissions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript in the context of the phpMyFAQ domain. This could lead to session hijacking, admin account takeover, and persistent XSS attacks. Victims clicking malicious SVG links may unknowingly grant attackers access to sensitive data or actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables stored cross-site scripting (XSS) attacks that could lead to unauthorized access to sensitive data, session hijacking, or admin account takeover. Such breaches may violate GDPR's data protection requirements (e.g., Article 32 on security of processing) and HIPAA's safeguards for protected health information (e.g., Security Rule).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpMyFAQ to version 4.2.0-beta or later immediately. Remove any untrusted SVG files from the server. Restrict FAQ_EDIT permissions to trusted users only. Implement additional input validation for SVG uploads to block XML DTD entities.

Useful 0 Not Useful 0