Description

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T12:17:22.697Z",
  "pubdate": "2026-09-04T12:17:22.697Z",
  "executiveSummary": "phpMyFAQ versions prior to 4.1.8 are susceptible to a stored cross-site scripting (XSS) vulnerability. The flaw originates in the FaqHelper::convertOldInternalLinks() function, which inadvertently reverses security encoding protections on previously sanitized FAQ content. This allows authenticated users with FAQ editing privileges to inject malicious JavaScript payloads directly into the application's database. When other users, including administrators or end-users, view the compromised FAQ entry, the injected script executes within the context of their active session. The risk is significant as it facilitates unauthorized actions, potential session hijacking, and the exposure of sensitive information. Exploitation requires authorized access to the FAQ editing interface, making the vulnerability a target for malicious insiders or compromised editorial accounts.",
  "technicalDetails": "The vulnerability resides within the FaqHelper::convertOldInternalLinks() method, which is responsible for processing and formatting legacy internal links within the FAQ content. The root cause is the improper use of the html_entity_decode() function on data that has already undergone sanitization. By applying html_entity_decode() to sanitized strings, the application effectively reverts HTML entity encoding, turning escaped characters back into their functional, executable HTML equivalents.\nThe exploitation flow begins when an authenticated user with sufficient privileges to modify FAQ entries injects a payload containing malicious JavaScript—such as <script>alert(document.cookie)</script>—into the content body. While initial input sanitization routines may correctly convert these characters into HTML entities (e.g., &lt;script&gt;), the subsequent call to FaqHelper::convertOldInternalLinks() during the rendering process triggers the decoding mechanism. This reversal restores the tag characters, thereby breaking the protection layer and transforming the inert text into an active script.\nWhen a victimized user accesses the FAQ page containing the malicious entry, the application retrieves the data from the database and passes it through the vulnerable FaqHelper function. The browser then interprets the decoded payload as legitimate HTML/JavaScript and executes it within the user's browser context. Since the script executes in the victim's session, the attacker can perform actions on behalf of the user, such as exfiltrating session tokens, intercepting form submissions, or performing unauthorized administrative actions if the victim holds high-level privileges. The vulnerability is stored in nature, meaning the payload persists in the database and automatically triggers for every user who views the affected FAQ document, leading to widespread impact across the user base."
}