PT-2024-2397 · Phpmyfaq · Phpmyfaq
Kevinnivekkevin
·
Published
2024-03-25
·
Updated
2025-01-09
·
CVE-2024-28107
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
phpMyFAQ versions prior to 3.2.6
Description
A SQL injection vulnerability has been discovered in the
insertentry and saveentry functions when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve remote code execution. The vulnerability can be exploited by modifying the email and notes parameters in the body of the POST request to the /admin/?action=insertentry and /admin/?action=saveentry API endpoints.Recommendations
To resolve the issue, update phpMyFAQ to version 3.2.6 or later. As a temporary workaround, consider restricting access to the
insertentry and saveentry functions until a patch is available. Additionally, restrict the use of the email and notes parameters in the affected API endpoints to minimize the risk of exploitation.Exploit
Fix
RCE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Phpmyfaq