8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-478m-mrw4-qf2w

GHSA-478m-mrw4-qf2w: Duplicate Advisory: phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pqh6-8fxf-jx22. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-478m-mrw4-qf2w

GHSA-478m-mrw4-qf2w:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	< 4.1.2	4.1.2
phpmyfaq/phpmyfaq	composer	< 4.1.2	4.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) attack in phpMyFAQ's search functionality. The root cause is a combination of improper input handling and insecure output rendering. An attacker with privileges to edit FAQs could inject a malicious payload encoded as HTML entities into a FAQ's question or answer. When a user performs a search, the phpMyFAQ\Controller\Api\SearchController.search method would fetch this content. It insecurely used html_entity_decode(strip_tags()), which allowed the encoded payload to bypass the tag stripper and be decoded back into executable HTML. This malicious data, prepared by functions like phpMyFAQ\Faq.renderFaqsByFaqIds and phpMyFAQ\Helper\SearchHelper.getSearchResult, was then passed to the search.twig template. The template rendered the content using the |raw filter, which disables Twig's auto-escaping, causing the malicious script to execute in the browser of anyone viewing the search results. A secondary issue existed in phpMyFAQ\Search.logSearchTerm, which logged unsanitized search terms. The patch addresses these issues by removing the dangerous html_entity_decode call, adding htmlentities encoding during data preparation, and sanitizing search terms before logging.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.