CVE-2025-68951: Thorsten/phpmyfaq Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jv8r-hv7q-p6vc",
  "modified" : "2025-12-31T22:13:13Z",
  "published" : "2025-12-29T22:12:35Z",
  "aliases" : [ "CVE-2025-68951" ],
  "summary" : "phpMyFAQ has Stored XSS in user list via admin-managed display_name",
  "details" : "### Summary\nA stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `&lt;img ...&gt;`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.\n\n### Details\nRoot cause is the following chain:\n- **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `&lt;img ...&gt;`).\n- **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (“for backward compatibility”).\n- **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`:\n  - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`)\n\nAs a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.\n\nNote: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field.\n\n### PoC (minimal reproduction)\n**Preconditions / configuration**\n- Registration enabled (`security.enableRegistration = true`).\n- Attacker does not need admin privileges.\n- Admin must view the admin user list page.\n\n**Steps**\n1. As an unauthenticated user, open the registration page and create a new account.\n2. Set the **display name / real name** field to the following entity-encoded payload:\n   - `&lt;img src=x onerror=alert(1)&gt;`\n3. Complete registration.\n4. As an administrator, open the admin user list (example):\n   - `http://127.0.0.1:8080/admin/user/list`\n5. Observe JavaScript execution in the admin’s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `<img>` element.\n\n### Impact\nStored XSS in the admin context can enable:\n- admin session compromise (depending on cookie flags),\n- CSRF token exfiltration and privileged admin actions,\n- UI redress/phishing within the admin panel.\n\n### Evidence (what I observed)\n- Stored DB value (entities):\n  `&lt;img src=x onerror=alert(1)&gt;`\n- Rendered HTML in admin user list:\n  `<img src=\"x\" onerror=\"alert(1)\">`\n\n### Affected versions\n**Confirmed by code inspection**\n- 4.0.14\n- 4.0.15\n  - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`.\n\n**Confirmed by live reproduction**\n- 4.1.0-RC (tested on current source checkout)\n\n### Environment (tested)\n- Host OS: macOS 15.6.1 (24G90)\n- Web container OS: Debian GNU/Linux 12 (bookworm)\n- PHP: 8.4.5RC1\n- DB: MariaDB 11.6.2\n- phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848\n\n### Contact / Credit\n- Contact: jeongwoolee340@gmail.com",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "thorsten/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.14"
      }, {
        "fixed" : "4.0.16"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-68951"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thorsten/phpMyFAQ"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-29T22:12:35Z",
    "nvd_published_at" : "2025-12-29T16:15:43Z"
  }
}