mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-2grw-mc9r-822r GHSA-48vw-jpf8-hwqh GHSA-6p68-36m6-392r GHSA-hm8r-95g3-5hj9 GHSA-qgxx-4xv5-6hcw
This commit is contained in:
advisory-database[bot]
File diff suppressed because one or more lines are too long
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-48vw-jpf8-hwqh",
|
||||
"modified": "2024-03-25T19:45:24Z",
|
||||
"published": "2024-03-25T19:45:23Z",
|
||||
"aliases": [
|
||||
"CVE-2024-28108"
|
||||
],
|
||||
"summary": "phpMyFAQ Stored HTML Injection at contentLink",
|
||||
"details": "### Summary\nDue to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._\n\n### PoC\n1. Browse to ../phpmyfaq/index.php?action=add&cat=0 , enter `https://test.com?p=<h1>HTML_INJECTION</h1>` for the contentLink parameter.\n\n\n2. Verify the HTML injection by viewing the FAQ itself, “All categories” → “CategoryName” → ”QuestionName”.\n\n\n### Impact\nAttackers can manipulate the appearance and functionality of web pages by injecting malicious HTML code. This can lead to various undesirable outcomes, such as defacing the website, redirecting users to malicious sites, or altering the content to deceive users. Additionally, unauthenticated HTML injection can compromise user privacy by displaying sensitive information or misleading content. It undermines the integrity of the application and erodes user trust, potentially resulting in loss of reputation and credibility. ",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "phpmyfaq/phpmyfaq"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.2.5"
|
||||
},
|
||||
{
|
||||
"fixed": "3.2.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"3.2.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ/commit/4fed1d9602f0635260f789fe85995789d94d6634"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79",
|
||||
"CWE-80"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-03-25T19:45:23Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6p68-36m6-392r",
|
||||
"modified": "2024-03-25T19:45:52Z",
|
||||
"published": "2024-03-25T19:45:52Z",
|
||||
"aliases": [
|
||||
"CVE-2024-28106"
|
||||
],
|
||||
"summary": "phpMyFAQ Stored Cross-site Scripting at FAQ News Content",
|
||||
"details": "### Summary\nBy manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.\n\n### PoC\n1. Edit a FAQ news, intercept the request and modify the `news` parameter in the POST body with the following payload: `%3cscript%3ealert('xssContent')%3c%2fscript%3e`\n2. Browse to the particular news page and the XSS should pop up.\n\n\n### Impact\nThis allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "phpmyfaq/phpmyfaq"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.2.5"
|
||||
},
|
||||
{
|
||||
"fixed": "3.2.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"3.2.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392r"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ/commit/c94b3deadd87789389e1fad162bc3dd595c0e15a"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-03-25T19:45:52Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hm8r-95g3-5hj9",
|
||||
"modified": "2024-03-25T19:45:12Z",
|
||||
"published": "2024-03-25T19:45:12Z",
|
||||
"aliases": [
|
||||
"CVE-2024-29179"
|
||||
],
|
||||
"summary": "phpMyFAQ Stored Cross-site Scripting at File Attachments",
|
||||
"details": "### Summary\nAn attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.\n\n### Details\nWhen attachments are uploaded without an extension, the application renders it as HTML by default. Therefore allowing attackers to upload .html files containing javascript code to perform XSS attacks. The direct file path to the uploaded attachment is also easily obtainable as it is made up of substrings of the file's MD5 hashes.\n\n### PoC\n1. Admin users can upload attachments containing XSS payloads in files without extensions to bypass the .html extension check.\n\n\n2. Since the path of the uploaded file is built entirely on the file’s MD5 hash and the attachment directory, it is possible for an attacker to know the direct path of the uploaded file.\n\n E.g file MD5 hash: 38fff51cb7248a06d6142c6bdf846831\n\n URL will be: http://127.0.0.1/phpmyfaq/attachments/38fff/51cb7/248a0/6d6142c6bdf846831\n\n - /attachments\n - /38fff (first 5 chars of MD5 hash)\n - /51cb7 (next 5 chars of MD5 hash)\n - /248a0 (next 5 chars of MD5 hash)\n - /6d6142c6bdf846831 (remaining chars of MD5 hash)\n\n3. Even though the attachment was uploaded without a file extension, it is still rendered as .html, hence triggering the XSS payload.\n\n\n### Impact\nThis allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session.\n\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "phpmyfaq/phpmyfaq"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.2.5"
|
||||
},
|
||||
{
|
||||
"fixed": "3.2.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"3.2.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/thorsten/phpMyFAQ"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-03-25T19:45:12Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user