By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.
news
parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3e
This allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session
{ "nvd_published_at": "2024-03-25T19:15:58Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:45:52Z" }