PT-2023-17214 · Phpmyfaq · Phpmyfaq

Published 2023-03-31 · Updated 2023-04-26 · CVE-2023-1754

Positive Technologies · (AI Summary)

CVSS v3.1

4.7

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions:

phpMyFAQ versions prior to 3.1.12

Description:

The issue is related to improper neutralization of input during web page generation, which can also be described as improper input validation. This affects the GitHub repository thorsten/phpmyfaq.

Recommendations:

For versions prior to 3.1.12, update to version 3.1.12 or later to resolve the issue.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2023-1754

GHSA-GVG8-R8W2-9GFJ

Affected Products

Phpmyfaq

References · 9

• 🔥 https://huntr.dev/bounties/529f2361-eb2e-476f-b7ef-4e561a712e28 · Exploit
• https://github.com/thorsten/phpmyfaq/commit/d773df925cb74e874527458beed1f66f966ec491 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-1754 · Security Note
• https://osv.dev/vulnerability/GHSA-gvg8-r8w2-9gfj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1754 · Vendor Advisory
• https://github.com/thorsten/phpmyfaq · Note
• https://t.me/cvenotify/47208 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1754 · Note
• https://t.me/cibsecurity/61230 · Telegram Post