Description

In a form version that appears to have no validation, it means that the website or application is not properly checking user inputs for malicious code before storing it in the database. This lack of validation allows an attacker to inject their own malicious script, which can then be executed by other users who access the affected page. This can lead to sensitive information being stolen, unauthorized actions being taken, and a variety of other security risks.

Proof of Concept

1.Go to https://roy.demo.phpmyfaq.de/admin/?action=config
2.Save Configuration and intercept
3.Edit main.currentVersion with xss payload </script><script>alert('1337')</</script><script>alert('1337')</script>script>
4.Forward request

https://drive.google.com/file/d/1Ws22NhQx3z68fUEQ-dcRelMSlFOTUorG/view?usp=share_link This xss will trigger in every domain that show version of phpmyfaq

Impact

XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user's session cookie, allowing an attacker to hijack the user's session and take over the account.