PT-2023-17311 · Unknown · Thorsten/Phpmyfaq

Published 2023-04-05 · Updated 2023-09-02 · CVE-2023-1883

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions thorsten/phpmyfaq versions prior to 3.1.12

Description The issue concerns improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, when FAQ News is marked as inactive in settings and comments are enabled, it allows comments to be posted on inactive FAQs.

Recommendations For versions prior to 3.1.12, update to version 3.1.12 to resolve the issue. As a temporary workaround, consider disabling comments on inactive FAQs until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-1883

GHSA-2WJP-W7G7-H63Q

Affected Products

Thorsten/Phpmyfaq

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1883.json · Exploit
• 🔥 https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191 · Exploit
• https://github.com/thorsten/phpmyfaq/commit/db77df888178766987398597d4f153831c62a503 · Patch
• https://osv.dev/vulnerability/GHSA-2wjp-w7g7-h63q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1883 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1883 · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://t.me/pentestingnews/37161 · Telegram Post
• https://t.me/defcon_news/115077 · Telegram Post
• https://t.me/cibsecurity/61489 · Telegram Post
• https://twitter.com/reverseame/status/1698225821276623119 · Twitter Post
• https://t.me/cvenotify/48121 · Telegram Post
• https://t.me/rnetsec/18870 · Telegram Post
• https://t.me/secharvester/13955 · Telegram Post