PT-2022-24035 · Phpmyfaq · Phpmyfaq

Published 2022-10-31 · Updated 2022-11-01 · CVE-2022-3765

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 3.1.8

Description The issue is related to stored Cross-site Scripting (XSS) in the phpMyFAQ repository. This type of attack involves an attacker injecting malicious scripts into a website, which are then stored on the server and executed by other users. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3765

GHSA-WR74-2V66-57PP

Affected Products

Phpmyfaq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3765.json · Exploit
• 🔥 https://huntr.dev/bounties/613143a1-8e51-449a-b214-12458308835d · Exploit
• https://github.com/thorsten/phpmyfaq/commit/372428d02a08e90b3a253ba5c506cda84581a5af · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3765 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3765 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr74-2v66-57pp · Vendor Advisory
• https://github.com/thorsten/phpmyfaq · Note
• https://t.me/cibsecurity/52279 · Telegram Post