stored Blind XSS in Admin Panel through FAQ-Proposal leads to Admin Full Account Takeover in thorsten/phpmyfaq

Valid

Reported on

Jan 26th 2023


Hello.

Vulnerability: Blind XSS in Admin Panel while generating Report

  1. Without beeing logged in the Application
  2. Go to FAQ-Proposal -> put an XSS Payload like <script>alert('1')</script> in the question Field
  3. Send the Proposal

  1. Admin will login
  2. The Proposal will pop up in the Category you specified while sending your Proposal here number 1 6 Admin will go to Statistics and then Reports
  3. Generate Report
  4. Blind XSS will be fired in the Admin Panel

Steal the Admin Cookies and do a Full Account Takeover of the Admin Account.

Best regards Ahmed Hassan

Impact

Hello.

Vulnerability: Blind XSS in Admin Panel while generating Report

  1. Without beeing logged in the Application
  2. Go to FAQ-Proposal -> put an XSS Payload like <script>alert('1')</script> in the question Field
  3. Send the Proposal

  1. Admin will login
  2. The Proposal will pop up in the Category you specified while sending your Proposal here number 1 6 Admin will go to Statistics and then Reports
  3. Generate Report
  4. Blind XSS will be fired in the Admin Panel

Steal the Admin Cookies and do a Full Account Takeover of the Admin Account.

Best regards Ahmed Hassan

We are processing your report and will contact the thorsten/phpmyfaq team within 24 hours. 2 months ago
ahmedvienna modified the report
2 months ago
thorsten/phpmyfaq maintainer has acknowledged this report 2 months ago
Thorsten Rinne modified the Severity from Critical (10) to High (8.4) 2 months ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Thorsten Rinne validated this vulnerability 2 months ago
ahmedvienna has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Thorsten Rinne marked this as fixed in 3.1.11 with commit ce676e 2 months ago
Thorsten Rinne has been awarded the fix bounty
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on Feb 28th 2023
Thorsten Rinne published this vulnerability 2 months ago
to join this conversation