CVE-2024-56199: phpMyFAQ HTML Injection DOS Vulnerability

CVE-2024-56199 Overview

CVE-2024-56199 is a stored HTML injection vulnerability in phpMyFAQ, an open source FAQ web application. The flaw affects versions starting no later than 3.2.10 and prior to 4.0.2. An authenticated attacker can inject malicious HTML content through the FAQ editor endpoint at /admin/index.php?action=editentry. The injected markup renders overlapping buttons, images, and iframes across the FAQ page. This breaks the intended layout and disrupts the user interface for legitimate users. The issue is tracked under [CWE-79] and was patched in version 4.0.2.

Critical Impact
Authenticated attackers can render the phpMyFAQ user interface unusable, enabling denial of service, defacement, and phishing scenarios against legitimate users.

Affected Products

phpMyFAQ versions 3.2.10 through 4.0.1
phpMyFAQ administrative FAQ editor component (admin/index.php?action=editentry)
All deployments exposing the admin interface to editor-level users

Discovery Timeline

2025-01-02 - CVE-2024-56199 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56199

Vulnerability Analysis

The vulnerability resides in the FAQ editor endpoint at admin/index.php?action=editentry. phpMyFAQ fails to properly sanitize HTML markup submitted through the FAQ content field. An attacker with editor privileges can submit malformed HTML that phpMyFAQ then stores and renders on public FAQ pages.

The injected payload uses styled HTML elements sized and positioned to cover the entire viewport. Overlapping buttons, images, and iframes are layered over legitimate page content. Legitimate visitors loading affected FAQ pages receive the injected markup as part of the rendered response.

The result is a denial of service against the FAQ presentation layer. Because the injection persists in stored FAQ content, every visitor to the affected entry receives the malicious layout. The attack also enables defacement and can host phishing UI elements that mimic trusted controls.

Root Cause

The root cause is improper neutralization of HTML input in the FAQ editor [CWE-79]. phpMyFAQ accepts rich HTML in FAQ entries but does not enforce an allowlist that strips overlay-capable elements, absolute positioning styles, and iframe embeds. Stored content is rendered without additional sanitization on the display path.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit FAQ entries. The attacker submits crafted HTML through the editor, saves the entry, and waits for legitimate users to load the affected FAQ. User interaction is required to trigger the payload because the injected content executes in the visitor's browser session.

The vulnerability manifests through the FAQ content submission workflow. See the GitHub Security Advisory GHSA-ww33-jppq-qfrp for advisory-level technical details.

Detection Methods for CVE-2024-56199

Indicators of Compromise

FAQ entries containing full-screen positioned HTML elements such as <iframe>, <img>, or <button> with inline styles setting position: fixed or position: absolute covering the viewport
Audit log entries showing edits to FAQ entries followed by user reports of broken or overlapping page rendering
Web server access logs showing POST requests to admin/index.php?action=savequestion or action=editentry from unexpected administrative accounts

Detection Strategies

Scan the phpMyFAQ database faqdata table for stored HTML containing overlay styles, iframes, or z-index manipulation not typical for FAQ authors
Compare current FAQ content against known-good baselines to identify unauthorized layout-modifying markup
Alert on administrative sessions creating or modifying multiple FAQ entries in rapid succession outside normal editorial patterns

Monitoring Recommendations

Enable and centralize phpMyFAQ admin action logs, correlating editor account activity with content changes
Monitor for unusual outbound iframe destinations rendered from FAQ pages, which may indicate phishing pivots
Track user-reported UI issues as an early signal of stored HTML injection in the public FAQ

How to Mitigate CVE-2024-56199

Immediate Actions Required

Upgrade phpMyFAQ to version 4.0.2 or later, which contains the vendor patch for this vulnerability
Audit all FAQ entries created or modified before the upgrade for embedded overlay markup and revert any suspicious content
Review editor and admin accounts, rotating credentials for any account that may have been misused to plant injected content

Patch Information

phpMyFAQ 4.0.2 contains the fix for CVE-2024-56199. Refer to the phpMyFAQ security advisory GHSA-ww33-jppq-qfrp for the vendor's remediation details and release notes.

Workarounds

Restrict the FAQ editor role to a minimal, trusted set of accounts until the upgrade is applied
Place the /admin/ path behind IP allowlisting or a reverse proxy requiring additional authentication
Apply a Content Security Policy that disallows inline styles and restricts frame-src to prevent overlay abuse on public FAQ pages

bash

# Example nginx restriction for the phpMyFAQ admin path
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; frame-src 'self'; style-src 'self'";
}