PT-2018-4271 · Phpmyfaq · Phpmyfaq

Jinen Patel + 1 · Published 2018-08-28 · Updated 2018-11-01 · CVE-2014-6046

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 2.8.13

Description The issue allows remote attackers to hijack the authentication of unspecified users for various requests, including deleting active users, deleting open questions, activating users, publishing FAQs, adding or deleting Glossary, adding or deleting FAQ news, adding or deleting comments, or adding votes. This is due to improper validation of CSRF tokens or a lack of a CSRF token.

Recommendations For versions prior to 2.8.13, update to version 2.8.13 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions that are vulnerable to CSRF attacks until the update is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-6046

Affected Products

Phpmyfaq

References · 5

• 🔥 https://exploit-db.com/exploits/34580 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-6046 · Security Note
• https://phpmyfaq.de/security/advisory-2014-09-16 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6046 · Note
• http://techdefencelabs.com/security-advisories.html · Note