CVE-2023-1880
published 2023-04-05CVE-2023-1880: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
PriorityP336medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.64%
73.5th percentile
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpmyfaq | phpmyfaq | < 3.1.12 | 3.1.12 |
| thorsten | phpmyfaq | >= 0 < 3.1.12 | 3.1.12 |
| thorsten | thorsten_phpmyfaq | >= unspecified < 3.1.12 | 3.1.12 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.08.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
ghsa·2023-04-05
CVE-2023-1880 [HIGH] CWE-79 thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the artlang parameter. This has been fixed in 3.1.12.
OSV
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
osv·2023-04-05
CVE-2023-1880 [HIGH] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the artlang parameter. This has been fixed in 3.1.12.
No detection rules found.
Nuclei
Phpmyfaq v3.1.11 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2023-1880 [MEDIUM] Phpmyfaq v3.1.11 - Cross-Site Scripting
Phpmyfaq v3.1.11 - Cross-Site Scripting
Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.
Template:
id: CVE-2023-1880
info:
name: Phpmyfaq v3.1.11 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized.
impact: |
Unauthenticated attackers can inject malicious JavaScript through the unsanitized artlang parameter in send2friend functionality to steal user session cookies.
remediation: Fixed in 3.1.12 Version.
reference:
- https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e
- https://nvd.nist.gov/vuln/detail/CVE-2023-1880
- https://github.com/thorsten/phpmyfaq/commit/bbc5d4aa4a4375c14e34dd
2023-04-05
Published