Thorsten phpMyFAQ authorization issue vulnerability

Versions of thorsten phpMyFAQ prior to 4.1.10 contain an authorization issue vulnerability. This vulnerability stems from an object-level authorization bypass; unauthenticated attackers can provide any openQuestionID in a POST request to /api/faq/create, thereby modifying or deleting any guest...

Thorsten phpMyFAQ server request forgery vulnerability

Versions of thorsten phpMyFAQ prior to 4.1.10 contain a server-side request forgery vulnerability. This vulnerability arises because the PDF export functionality relies on external images referenced in FAQ responses; server-side request forgery occurs when attackers embed image URLs pointing to...

Improper Privilege Management

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Privilege Management via the updateUserRights method in UserController.php, where a non-SuperAdmin administrator with the USEREDIT right can...

Cross-site Request Forgery (CSRF)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Th...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the attachment download endpoint attachment.php due to a flawed permission check. The condition $groupPermission ||...

Authorization Bypass Through User-Controlled Key

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the update method in FaqController.php, where the REST API FAQ update endpoint enforces only a glob...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the deleteUser API in src/phpMyFAQ/Controller/Administration/Api/UserController.php, where an authenticated non-superadmin use...

Improper Verification of Cryptographic Signature

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the register method in AuthWebAuthn.php, which fails to validate the WebAuthn registration challeng...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the escape method in PdoMysql.php, which uses backslash escaping ' that is rendered ineffective when the MySQL/MariaDB server operates...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

Improper Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the htmlentitydecode process. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient permission checks on admin content pages. An attacker can access unpublished content by leveraging add...

Improper Control of Interaction Frequency

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Control of Interaction Frequency via the store parameter in question submission requests. An attacker can submit unlimited questions without...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

Unverified Password Change

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the FaqHelper::convertOldInternalLinks process, which calls htmlentitydecode on sanitized FAQ content, reversing...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the Dashboard API endpoints searches and content-health, which enforce only authentication without proper permission checks. A...

Use of Single-factor Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication through the removeTwofactorConfig process and the twofactorenabled form field, which are accessible via POST...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization in the question/create endpoint due to the isAddingQuestionsAllowed method granting access to all callers when...