{"id":"GHSA-jv8r-hv7q-p6vc","summary":"phpMyFAQ has Stored XSS in user list via admin-managed display_name","details":"### Summary\nA stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `<img ...>`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.\n\n### Details\nRoot cause is the following chain:\n- **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `<img ...>`).\n- **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (“for backward compatibility”).\n- **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`:\n  - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`)\n\nAs a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.\n\nNote: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field.\n\n### PoC (minimal reproduction)\n**Preconditions / configuration**\n- Registration enabled (`security.enableRegistration = true`).\n- Attacker does not need admin privileges.\n- Admin must view the admin user list page.\n\n**Steps**\n1. As an unauthenticated user, open the registration page and create a new account.\n2. Set the **display name / real name** field to the following entity-encoded payload:\n   - `<img src=x onerror=alert(1)>`\n3. Complete registration.\n4. As an administrator, open the admin user list (example):\n   - `http://127.0.0.1:8080/admin/user/list`\n5. Observe JavaScript execution in the admin’s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `\u003cimg\u003e` element.\n\n### Impact\nStored XSS in the admin context can enable:\n- admin session compromise (depending on cookie flags),\n- CSRF token exfiltration and privileged admin actions,\n- UI redress/phishing within the admin panel.\n\n### Evidence (what I observed)\n- Stored DB value (entities):\n  `<img src=x onerror=alert(1)>`\n- Rendered HTML in admin user list:\n  `\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e`\n\n### Affected versions\n**Confirmed by code inspection**\n- 4.0.14\n- 4.0.15\n  - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`.\n\n**Confirmed by live reproduction**\n- 4.1.0-RC (tested on current source checkout)\n\n### Environment (tested)\n- Host OS: macOS 15.6.1 (24G90)\n- Web container OS: Debian GNU/Linux 12 (bookworm)\n- PHP: 8.4.5RC1\n- DB: MariaDB 11.6.2\n- phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848\n\n### Contact / Credit\n- Contact: jeongwoolee340@gmail.com","aliases":["CVE-2025-68951"],"modified":"2026-02-03T03:15:42.297315Z","published":"2025-12-29T22:12:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-12-29T22:12:35Z","nvd_published_at":"2025-12-29T16:15:43Z","cwe_ids":["CWE-79"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68951"},{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"},{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"}],"affected":[{"package":{"name":"thorsten/phpmyfaq","ecosystem":"Packagist","purl":"pkg:composer/thorsten/phpmyfaq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.14"},{"fixed":"4.0.16"}]}],"versions":["4.0.14","4.0.15"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jv8r-hv7q-p6vc/GHSA-jv8r-hv7q-p6vc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}