phpMyFAQ Stored Cross-site Scripting at FAQ News Content
SummaryBy manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.PoCEdit a FAQ news, intercept the request and modify the `news` parameter in the POST body with the following payload:  `%3cscript%3ealert('xssContent')%3c%2fscript%3e`Browse to the particular news page and the XSS should pop up.
![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/01312703-c54c-4ee6-9f2c-0dd1bf1b23cf)ImpactThis allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session