Executive brief
phpMyFAQ is a frequently asked questions (FAQ) management system. An unauthenticated user can inject malicious JavaScript code into an FAQ submission that executes in an administrator's browser when they review or edit the entry, enabling session hijacking and full admin account takeover. The vulnerability exists in the default configuration where guests can submit FAQs and rich-text editing is enabled.
Technical details
A stored XSS vulnerability in the FAQ submission API (phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php) arises from improper input sanitization. The code applies `strip_tags()` via `FILTER_SANITIZE_SPECIAL_CHARS` to remove HTML tags, but `strip_tags()` does not remove HTML entities (e.g., `<script>`). When the WYSIWYG editor is enabled on the frontend, a subsequent call to `html_entity_decode()` converts these entities to executable HTML before storage in the database. The admin FAQ editor template (phpmyfaq/assets/templates/admin/content/faq.editor.twig) renders the stored content with Twig's `|raw` filter, executing the injected script in the administrator's browser context. An unauthenticated attacker can craft a POST request to the `/api/faq/create` endpoint with a payload using HTML entity encoding (e.g., `</textarea><img src=x onerror=alert()><textarea>`) to break out of the textarea element and trigger JavaScript execution when an admin edits the submission.
Affected products
- phpMyFAQ phpMyFAQ
Timeline
- 2026-09-24: disclosed