GHSA-x2v3-9p22-w3x6
phpMyFAQ contains a CSV injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | thorsten/phpmyfaq | <= 3.1.12 | no fix listed |
| Packagist | phpmyfaq/phpmyfaq | <= 3.1.12 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
References
External links from the advisory. They lead to third-party sites.