CVE-2024-29179: 
PHP vulnerability analysis and mitigation

phpMyFAQ, an open source FAQ web application for PHP 8.1+ and MySQL/PostgreSQL, was found to contain a stored XSS vulnerability (CVE-2024-29179) in version 3.2.5. The vulnerability was discovered and disclosed on March 25, 2024, affecting the file attachment functionality of the application (GitHub Advisory).

The vulnerability stems from improper file handling where attachments uploaded without an extension are rendered as HTML by default. The application fails to properly validate these files, allowing JavaScript code execution. The file path of uploaded attachments is predictable as it's constructed using substrings of the file's MD5 hash, making it easier for attackers to locate and exploit uploaded malicious files. The vulnerability has been assigned a CVSS v3.0 base score of 4.3 (Medium) with vector string CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L (NVD).

The vulnerability allows attackers with administrative privileges to execute arbitrary client-side JavaScript within the context of other users' phpMyFAQ sessions. This could lead to unauthorized access to user data and potential manipulation of the application's functionality (GitHub Advisory).

The vulnerability requires an attacker to have administrative privileges and user interaction for successful exploitation. The predictable nature of the file path (based on MD5 hash) makes it easier for attackers to locate uploaded malicious files. For example, if a file has an MD5 hash of '38fff51cb7248a06d6142c6bdf846831', its URL would be constructed as '/attachments/38fff/51cb7/248a0/6d6142c6bdf846831' (GitHub Advisory).

The vulnerability has been patched in version 3.2.6 of phpMyFAQ (GitHub Advisory).