Lucene search
Mohamedabdelhady933C03C5925-43FF-450D-9827-2B65A3307ED6HistoryDec 17, 2022 - 2:35 p.m.
Blind Stored XSS in admin panel (open question page)
2022-12-1714:35:21
mohamedabdelhady933
www.huntr.dev
17
blind xss
stored xss
admin panel
unauthorized user
add question page
open question page
0.0005 Low
EPSS
Percentile
17.9%
Description
Blind stored XSS via any unauthorized or anonymous (visitor) user without any privileges can inject XSS payload in “Add question” page in “Your Name” input field then it will be executed in admin panel in Open Question page
Proof of Concept
https://drive.google.com/file/d/1RusFJNXtxx-bzELJZLk-ZZZH0lX6ydWp/view?usp=sharing
Related
nvd
nvd
CVE-2023-0309
2023-01-15 22:15:10
cnvd
cnvd
phpMyFAQ Cross-Site Scripting Vulnerability (CNVD-2023-04317)
2023-01-16 00:00:00
cvelist
cvelist
CVE-2023-0309 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
2023-01-15 00:00:00
cve
cve
CVE-2023-0309
2023-01-15 22:15:10
osv
osv
phpMyFAQ Stored Cross-site Scripting vulnerability
2023-01-16 00:30:24
CVE-2023-0309
2023-01-15 22:15:10
veracode
veracode
Cross-site Scripting (XSS)
2023-01-26 05:17:38
prion
prion
Cross site scripting
2023-01-15 22:15:00
github
github
phpMyFAQ Stored Cross-site Scripting vulnerability
2023-01-16 00:30:24
openvas
openvas
phpMyFAQ < 3.1.10 Multiple Vulnerabilities
2023-01-16 00:00:00