config.toml

baseurl = "http://www.example.com"
title = "AppSec Enthusiast"
theme = "hugo-coder"
languagecode = "en"
defaultcontentlanguage = "en"

paginate = 20
canonifyurls = true

pygmentsstyle = "bw"
pygmentscodefences = true
pygmentscodefencesguesssyntax = true

disqusShortname = "yourdiscussshortname"

[params]
    author = "Ishaq Mohammed"
    info = "AppSec Enthusiast"
    description = "Ishaq's AppSec Blog"
    keywords = "AppSec,DevSecOps,Security"
    avatarurl = "author.jpg"

    favicon_32 = "/img/favicon-32x32.png"
    favicon_16 = "/img/favicon-16x16.png"

    footercontent = ""

    hidecredits = false
    hidecopyright = false

    rtl = false

    math = true
    custom_css = ["css/custom.css"]
    colorscheme = "dark	"


# Social links
 
 [[params.social]]
    name = "LinkedIn"
    icon = "fab fa-linkedin fa-2x"
    weight = 4
    url = "https://www.linkedin.com/in/security-prince"		

 [[params.social]]
    name = "Github"
    icon = "fab fa-github fa-2x"
    weight = 1
    url = "https://github.com/security-prince"
 
 [[params.social]]
    name = "Facebook"
    icon = "fab fa-facebook"
    weight = 4
    url = "https://facebook.com/s3curityprince"

[[params.social]]
    name = "Twitter"
    icon = "fab fa-twitter fa-2x"
    weight = 3
    url = "https://twitter.com/security_prince"

[[params.social]]
    name = "reddit"
    icon = "fab fa-reddit"
    weight = 4
    url = "https://www.reddit.com/user/security_prince"

# Menu links
[[menu.main]]
    name = "Blog"
    weight = 1
    url  = "/posts/"
[[menu.main]]
    name = "About"
    weight = 2
    url = "/about/"



    # Specify light/dark colorscheme
    # Supported values:
    # "auto" (use preference set by browser)
    # "dark" (dark background, light foreground)
    # "light" (light background, dark foreground) (default)
    colorscheme = "dark"

cve-2017-14618-phpmyfaq-298-cross-site.md

+++ draft = false date = 2017-10-12T14:59:35+05:30 title = "CVE-2017-14618 - PHPMyFAQ 2.9.8 - Cross-Site Scripting" description = "" slug = "" tags = [] categories = [] externalLink = "" series = [] +++

Security Advisory: CVE-2017-14618 - PHPMyFAQ 2.9.8 - Cross-Site Scripting

OVERVIEW
Severity Rating: Medium
Confirmed Affected Versions: 2.9.8
Confirmed Patched Versions: 2.9.9

Vendor: phpMyFAQ

Vendor URL: http://www.phpmyfaq.de/
Vector: Remote
Status: Public
CVE: CVE-2017-14618
ExploitDB URL: https://www.exploit-db.com/exploits/42761/
phpMyFAQ Security Advisory: http://www.phpmyfaq.de/security/advisory-2017-10-19

PRODUCT DESCRIPTION
phpMyFAQ is a multilingual, completely database-driven FAQ-system. It supports various databases to store all data, PHP 5.4.4+ or HHVM 3.4.2+ is needed in order to access this data. phpMyFAQ also offers a multi-language Content Management System with a WYSIWYG editor and an Image Manager, flexible multi-user support with user and group based permissions on categories and records, a wiki-like revision feature, a news system, user-tracking, 40+ supported languages, enhanced automatic content negotiation, HTML5/CSS3 based templates, PDF-support, a backup-system, a dynamic sitemap, related FAQs, tagging, RSS feeds, built-in spam protection systems, OpenLDAP and Microsoft Active Directory support, and an easy to use installation script.
phpMyFAQ is developed and maintained by Thorsten Rinne
SUMMARY AND IMPACT
Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
In phpMYFAQ Administrator has the privilege to "Add New FAQ" on the phpMyFAQ Portal. The “Questions” field does not properly filter and sanitize the user input which thus, results into a Stored Cross Site Scripting Vulnerability.
Whenever any user visits this portal, the admin’s (attacker’s) malicious JavaScript will be executed by the newly added faq on the user’s browser.

PROOF OF CONCEPT

WORKAROUNDS

There is no workaround except for updating to the latest version of phpMyFAQ from here

Advisory Update: November 13, 2017