CVE-2022-3766: Reflect Cross Site Scripting when search in phpmyfaq

Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

Proof of Concept

1. Go to your web phpmyfaq and visit http://<ip>/phpmyfaq/index.php?search=
2. inject payload to param search: 1af"+onclick=’alert(1)'
3. Click on field search, you will see the popup XSS (xss executed)

Image Poc Execute: https://drive.google.com/file/d/1VSAqG3MY7uyuXzl1OwrNa-c1g1A0iv2l/view?usp=sharing

Impact

Attacker can execute javascript, steal the cookie.