CVE-2023-1758: thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Other sources
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12.
— GitHub
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/thorsten/phpmyfaqto a version that resolves this vulnerability.Fixed in 3.1.12 - Upgrade
Upgrade
thorsten/phpmyfaqto a version that resolves this vulnerability.Fixed in 3.1.12
Event History
Frequently Asked Questions
What is the vulnerability CVE-2023-1758?
The vulnerability CVE-2023-1758 is a Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in the GitHub repository thorsten/phpmyfaq prior to version 3.1.12.
What is the severity of CVE-2023-1758?
The severity of CVE-2023-1758 is high (5.4).
How does CVE-2023-1758 affect the phpmyfaq software?
CVE-2023-1758 affects the phpmyfaq software with versions prior to 3.1.12.
How can I fix the vulnerability CVE-2023-1758?
To fix the vulnerability CVE-2023-1758, update the phpmyfaq software to version 3.1.12 or later.
Where can I find more information about CVE-2023-1758?
You can find more information about CVE-2023-1758 at the following references: [GitHub commit](https://github.com/thorsten/phpmyfaq/commit/f3380f46c464d1bc6f3ded29213c79be0de8fc57) and [Huntr.dev bounty](https://huntr.dev/bounties/0854328e-eb00-41a3-9573-8da8f00e369c).