HTML-Injection in thorsten/phpmyfaq

Valid

Reported on

Jan 21st 2023


Dear Ladies and Gentlemen,

First of all thank you for your time and effort reading my Report.

While doing the Penetration Test i was able to identify an reflected HTML-Injection.

The Process of the Vulnerability:

  1. Login
  2. Go to https://roy.demo.phpmyfaq.de/admin/?action=tags
  3. Type any kind of HTML Code and it will be interpreted as HTML Code Example for the HTML Code: <h1> HTML INJECTION BY AHMED HASSAN</h1> or </h2>special offer <a href=www.evil.com>malicious link</a><h2>

The Attacker can inject Link, Phishing Links, etc. to inject malicious Code

Through this, any Attacker can inject HTML Code and use further Vulnerabilities to use other Exploitation Steps.

At the end, I want to thank you for your time and effort and hope hearing from you soon.

Best regards Ahmed Hassan

Impact

Dear Ladies and Gentlemen,

First of all thank you for your time and effort reading my Report.

While doing the Penetration Test i was able to identify an reflected HTML-Injection.

The Process of the Vulnerability:

  1. Login
  2. Go to https://roy.demo.phpmyfaq.de/admin/?action=tags
  3. Type any kind of HTML Code and it will be interpreted as HTML Code Example for the HTML Code: <h1> HTML INJECTION BY AHMED HASSAN</h1> or </h2>special offer <a href=www.evil.com>malicious link</a><h2>

The Attacker can inject Link, Phishing Links, etc. to inject malicious Code

Through this, any Attacker can inject HTML Code and use further Vulnerabilities to use other Exploitation Steps.

At the end, I want to thank you for your time and effort and hope hearing from you soon.

Best regards Ahmed Hassan

We are processing your report and will contact the thorsten/phpmyfaq team within 24 hours. 2 months ago
We have contacted a member of the thorsten/phpmyfaq team and are waiting to hear back 2 months ago
Thorsten Rinne validated this vulnerability 2 months ago
ahmedvienna has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Thorsten Rinne marked this as fixed in 3.1.11 with commit d89645 2 months ago
Thorsten Rinne has been awarded the fix bounty
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on Feb 28th 2023
ahmedvienna
2 months ago

Researcher


Good Morning,

I hope you are okay. I wanted to mention that my Brother Josef Hassan (mohammedzidan99@gmail.com) was part of identifying this Vulnerability.

Therefore, I will be more than happy if you can put his Name and (E-Mail Address as a Security Researcher with me.

I would appreciate hearing from you soon and wish you a wonderful day.

Best regards Ahmed Hassan

Thorsten Rinne published this vulnerability 2 months ago
to join this conversation