CVE-2024-24574: phpMyFAQ XSS Vulnerability

CVE-2024-24574 Overview

CVE-2024-24574 is a reflected Cross-Site Scripting (XSS) vulnerability in phpMyFAQ, an open source FAQ web application built for PHP 8.1+ with support for MySQL, PostgreSQL, and other databases. The flaw resides in phpmyfaq/admin/attachments.php, where a filename value is echoed to the response without proper output encoding. An authenticated administrator who views a crafted attachment can trigger execution of attacker-controlled JavaScript in the browser context of the admin console. The vulnerability is tracked under CWE-79 and was patched in phpMyFAQ version 3.2.5.

Critical Impact
Successful exploitation executes arbitrary JavaScript in an administrator's browser session, enabling session theft, admin action abuse, and pivoting to further compromise of the FAQ platform.

Affected Products

phpMyFAQ versions prior to 3.2.5
Deployments running the affected admin/attachments.php component
Installations on PHP 8.1+ with MySQL, PostgreSQL, or other supported databases

Discovery Timeline

2024-02-05 - CVE-2024-24574 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24574

Vulnerability Analysis

The vulnerability is a stored/reflected XSS in the phpMyFAQ administrative attachments interface. The file phpmyfaq/admin/attachments.php renders an uploaded attachment's filename directly into HTML output without applying context-appropriate encoding. Because the filename is user-controlled at upload time, an attacker who can influence attachment metadata can inject HTML or JavaScript that later executes when an administrator loads the attachments page.

Exploitation requires user interaction: an administrator must browse to the attachments view. Once rendered, the injected script runs with the privileges and session of the viewing administrator. The scope change reflects that the injected script can pivot from the vulnerable component into other browser contexts, including cookies and administrative endpoints.

Root Cause

The root cause is missing output encoding on filename data rendered by admin/attachments.php. PHP's echo was used against untrusted input rather than a sanitizing helper. The upstream fix imports the phpMyFAQ\Strings utility class and routes the filename through a sanitizing render path so that HTML metacharacters are neutralized before being sent to the browser.

Attack Vector

An attacker with permission to upload or influence an attachment stages a payload inside the filename. When an administrator opens the attachments management page, the browser parses the unescaped payload as HTML and executes any embedded script. From that foothold, the script can issue authenticated requests as the administrator, exfiltrate the session, or modify FAQ content.

php

// Security patch in phpmyfaq/admin/attachments.php
// Source: https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Translation;
 use phpMyFAQ\Utils;
+use phpMyFAQ\Strings;
 use Symfony\Component\HttpFoundation\Request;

 if (!defined('IS_VALID_PHPMYFAQ')) {

The patch introduces the phpMyFAQ\Strings helper so the filename can be sanitized prior to rendering, closing the unsafe echo path.

Detection Methods for CVE-2024-24574

Indicators of Compromise

Attachment records whose filename fields contain HTML tags, <script> fragments, event handlers such as onerror=, or javascript: URIs.
Web server access logs showing administrator sessions loading admin/attachments.php shortly after suspicious uploads.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following an attachments page view.

Detection Strategies

Inspect the phpMyFAQ attachments database table for filename values containing angle brackets, quotes, or scripting keywords.
Deploy a Content Security Policy (CSP) in report-only mode and review violations originating from the admin attachments page.
Add web application firewall (WAF) rules that flag file upload requests whose filename field contains HTML control characters.

Monitoring Recommendations

Alert on new file uploads to phpMyFAQ made by low-privilege or anonymous users, especially those preceding admin activity.
Correlate administrator authentication events with subsequent anomalous API calls that could indicate session-riding by injected script.
Track the installed phpMyFAQ version across environments and alert when instances remain below 3.2.5.

How to Mitigate CVE-2024-24574

Immediate Actions Required

Upgrade all phpMyFAQ instances to version 3.2.5 or later, which contains commit 5479b4a4603cce71aa7eb4437f1c201153a1f1f5.
Audit existing attachment filenames and rename or delete any entries containing HTML or scripting syntax.
Force administrator session invalidation after upgrading to invalidate any tokens that may have been captured through prior exploitation.

Patch Information

The fix is delivered in phpMyFAQ 3.2.5. See the GitHub Security Advisory GHSA-7m8g-fprr-47fx, the merged Pull Request #2827, and the upstream commit that introduces the phpMyFAQ\Strings sanitizer in admin/attachments.php.

Workarounds

Restrict access to admin/attachments.php by IP allow-list at the web server or reverse proxy until the upgrade is applied.
Enforce a strict Content Security Policy that disallows inline script execution in the administrative interface.
Validate uploaded filenames server-side, rejecting any that contain characters outside a safe allow-list such as [A-Za-z0-9._-].

bash

# Example nginx configuration restricting admin access and adding CSP
location /admin/attachments.php {
    allow 10.0.0.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}