phpMyFAQ Security Advisories

Security Advisory 2026-08-20

2026-08-20T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-08-20
Software:: phpMyFAQ <= 4.1.7
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.7 and earlier.

Description

High severity

When the WYSIWYG editor is enabled for the frontend, a FAQ submitted by an unauthenticated visitor is stripped of HTML tags but not of HTML entities, which are decoded back into executable HTML afterwards. The administration FAQ editor renders this content unsanitized, so the injected script executes in the administrator's browser when the submission is reviewed, allowing session theft and admin account takeover.

Two-factor authentication can be disabled with only a valid session and CSRF token, without re-entering the password or a one-time code, so an attacker with temporary access to a logged-in session can permanently remove the second factor from the account.

The user control panel API changes the account password without verifying the current password, so an attacker with temporary access to a logged-in session can take over the account permanently.

Moderate severity

The chat user search escapes SQL string syntax but not the LIKE wildcards % and _, so any authenticated user can bypass the intended display-name filter and enumerate the active users of an installation.

The CAPTCHA on the anonymous question form is not validated when the request is submitted with the store=now parameter, allowing automated spam submissions.

Incorrect permission checks on the news editing and FAQ translation pages in the administration disclose drafts and inactive content to users without the corresponding permissions.

The user data export ZIP includes the live TOTP secret, so anyone who obtains the export can generate valid second factors for the account.

The admin dashboard API endpoints for searches and content health only require a login instead of the corresponding permission, so any authenticated user can read this data.

FAQ rendering reverses sanitization with html_entity_decode(), turning previously escaped markup back into executable HTML and allowing stored cross-site scripting.

Low severity

Guests can submit questions even when allowQuestionsForGuests is disabled, as long as the ask-questions feature is enabled.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.8, which fixes the vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version. The fixes are also included in phpMyFAQ 4.2.0-alpha.2.

Workaround

There's no workaround except installing phpMyFAQ 4.1.8.

Thanks

The phpMyFAQ team would like to thank JosanGeorge, proochicken, skeletonsec, and pavelkohout396 for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-08-04

2026-08-04T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-08-04
Software:: phpMyFAQ <= 4.1.6
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.6 and earlier.

Description

High severity

The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim.

The brute-force throttle protecting the administration two-factor prompt is scoped to the session. An attacker who starts with a fresh cookie jar resets the counter and can guess TOTP codes without any effective rate limit.

An LDAP login silently reactivates a local account that an administrator has blocked, and the state change is not written to the audit log, so a revoked user regains access unnoticed.

The remember-me cookie is issued before the second factor has been verified. An attacker who knows only the password can keep the cookie from the incomplete login and use it to return as the fully authenticated user, bypassing two-factor authentication.

Glossary input is escaped before it is truncated. Truncation can cut an escape sequence in half, which allows an authenticated user to inject SQL into the resulting query.

A tracking file below the document root is served without authentication and contains password reset tokens, allowing an unauthenticated visitor to take over the accounts those tokens belong to.

Moderate severity

The public PDF export does not check whether a FAQ record is active, so an unauthenticated visitor can retrieve the title and solution of drafts and unpublished entries.

Comment endpoints do not verify authorization for the parent FAQ record, exposing the comments, the personal data of the commenters, and attachment metadata of restricted records.

The PostgreSQL search backend declares the wrong LIKE ESCAPE character, which makes the wildcard-escaping fix ineffective on that backend.

The administration API endpoints that read the LDAP, Elasticsearch, OpenSearch, and dashboard configuration only require a login instead of the CONFIGURATION_EDIT permission, so any authenticated user can read these settings.

An authenticated FAQ editor can reference a local file as an image in a FAQ entry and have the PDF export embed and disclose its contents.

The registration endpoints remain reachable even when security.enableRegistration is turned off, so visitors can still create accounts on an installation that is meant to be closed.

The content backup is written as a ZIP archive into the web-accessible document root, where anyone who guesses or learns its name can download the full contents of the installation.

The backup, database migration, and maintenance mode endpoints can be reached without authentication, allowing an unauthenticated attacker to export data or put the installation into maintenance mode.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.7, which fixes the vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.7.

Thanks

The phpMyFAQ team would like to thank Arpit Jain, Thomas Youssef Wilson, pavelkohout396, and kevinnivekkevin for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-07-13

2026-07-13T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-07-13
Software:: phpMyFAQ <= 4.1.5
Risk:: Critical
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.5 and earlier.

Description

An authenticated administrator can supply an untrusted update-package path to the configuration API, causing phpMyFAQ to write an arbitrary PHP file to the server and thereby execute attacker-controlled code.

An attacker can exploit a path traversal in the category image deletion routine to remove arbitrary files outside the intended directory, which can leave the installation in a state that allows a setup takeover.

The two-factor authentication login flow can be completed without verifying the password factor, so an attacker who possesses only the second factor is able to authenticate as the victim.

A delegated administrator with only the GROUP_EDIT permission can assign group memberships without restriction through GroupController::updateMembers, inheriting rights they do not hold and escalating their privileges.

An authenticated user can inject SQL through an unescaped stop word inserted via StopWords::add(), allowing manipulation of the underlying database query.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.6, which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.6.

Thanks

The phpMyFAQ team would like to thank ImDuong, geo-chen, DomainXTech, and Waseem Dayili for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-06-14

2026-06-14T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-06-14
Software:: phpMyFAQ <= 4.1.4
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.4 and earlier.

Description

An authenticated FAQ editor can embed a crafted image reference (e.g. ../../) in a FAQ entry to make the PDF export read arbitrary files outside the content directory and disclose them in the document.

An unauthenticated user can query the public FAQ APIs directly to retrieve inactive content — drafts, unpublished revisions, and entries awaiting approval — that was never meant to be public.

A delegated administrator with only the GROUP_EDIT permission can grant a group rights they do not hold and inherit them as a member, escalating up to full administrative control. The group-rights endpoint (GroupController::updatePermissions) lacks the constraint applied to the user-rights endpoint (UserController::updateUserRights).

A delegated administrator who holds the ordinary user-management permission (USER_ADD/EDIT/DELETE) but is not a SuperAdmin can create a brand-new account with the SuperAdmin flag and an attacker-chosen password and then log in as that account for full instance takeover. The SuperAdmin guard added to editUser, updateUserRights, overwritePassword, and activate was not applied to the sibling user/add endpoint.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.5, which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.5.

Thanks

The phpMyFAQ team would like to thank Yanchon918s, YHalo-wyh, and DomainXTech for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-05-25

2026-05-25T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-05-25
Software:: phpMyFAQ <= 4.1.3
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.3 and earlier.

Description

A high-risk issue existed where a previous fix for the admin API Insecure Direct Object Reference (IDOR) and privilege-escalation class of vulnerabilities was incomplete, leaving paths through which an attacker could still access or modify resources belonging to other users. The affected endpoints now enforce ownership and permission checks consistently.

A high-risk issue existed where the fix for CVE-2026-24421 was incomplete: four API write endpoints still lacked a userHasPermission() check, allowing authenticated users to perform privileged write operations they were not authorized for. The missing permission checks have been added to all affected endpoints.

A low-risk issue existed where phpMyFAQ hashed attachment passwords with SHA-1, a cryptographically broken algorithm that has been susceptible to practical collision attacks since the 2017 SHAttered disclosure. The affected code was unused and has been removed.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.4, which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.4.

Thanks

The phpMyFAQ team would like to thank N0tFix3d, SnailSploit, and santhoshinipayload for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-05-14

2026-05-14T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-05-14
Software:: phpMyFAQ <= 4.1.2
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.2 and earlier.

Description

phpMyFAQ contains an authentication bypass vulnerability where the default empty API token allows unauthorized access to protected endpoints.

An Insecure Direct Object Reference (IDOR) flaw in phpMyFAQ enables attackers to take over arbitrary user accounts by manipulating object identifiers.

An unauthenticated password reset endpoint in phpMyFAQ permits user enumeration and forces password changes without validating the reset token.

A missing password reset token check in phpMyFAQ allows account takeover through username and email enumeration.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.3, which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.3.

Thanks

The phpMyFAQ team would like to thank guayu-kakeru, i.cyber.sa, and kitu232 for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-04-28

2026-04-28T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-04-28
Software:: phpMyFAQ <= 4.1.1
Risk:: Critical
Platforms:: all

The phpMyFAQ Team has learned of critical security issues that'd been discovered in phpMyFAQ 4.1.1 and earlier.

Description

The User-Agent header in BuiltinCaptcha is vulnerable to unauthenticated SQL injection, rated critical.

In Client::deleteClientFolder, a moderate path traversal flaw lets non-super-admin admins delete arbitrary directories.

Through the getFaqBySolutionId fallback query, attackers can bypass FAQ permissions without authentication — severity high.

Unescaped OAuth token fields introduce a high severity SQL injection in CurrentUser::setTokenData.

Because /admin/check accepts an arbitrary user-id, an unauthenticated 2FA brute-force attack is possible (critical).

Due to an insufficient authorization check, ordinary authenticated users can reach admin-only API endpoints — a moderate issue.

Search result rendering in search.twig suffers from a moderate stored XSS, where the | raw filter bypasses html_entity_decode(strip_tags()).

Twelve admin API configuration tab endpoints lack the CONFIGURATION_EDIT permission check, leaking configuration data to any authenticated user (moderate).

The SVG sanitizer's entity decoding depth limit can be bypassed, resulting in stored XSS at moderate severity.

An encode-decode bypass of removeAttributes() sanitization enables moderate stored XSS in FAQ question and answer content.

Tag deletion lacks an authorization check, so any authenticated user can delete tags — rated moderate.

A non-terminating permission check causes a moderate authorization bypass across all admin pages.

Comment rendering is affected by a high severity stored XSS through Utils::parseUrl().

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.2, which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.2.

Thanks

The phpMyFAQ team would like to thank ericliu-12, offset, Doodi101, kitu232, and adragos for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-03-31

2026-03-31T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-03-31
Software:: phpMyFAQ <= 4.1.0
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.0 and earlier.

Description

An unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321

(quoted local part) yet contains raw HTML.

An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records.

The regex-based SVG sanitizer in phpMyFAQ can be bypassed using HTML entity encoding in JavaScript URLs within SVG

attributes.

The MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is

triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path

traversal validation.

An attacker can bypass sanitization by submitting FAQ content with unquoted or single-quoted event handler attributes.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.1.1, which fix the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.1.1.

Thanks

The phpMyFAQ team would like to thank wooseokdotkim, Athul Jayaram, Mạnh NV, and Khaled M. Alshammri

for the responsible disclosures of these vulnerabilities.

Security Advisory 2026-02-27

2026-02-27T00:00:00Z

Unauthenticated account creation vulnerability in phpMyFAQ

Issued on:: 2026-02-27
Software:: phpMyFAQ <= 4.0.17
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.0-RC.6, and earlier.

Description

The WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication,

CSRF protection, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even

when registration is disabled.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 4.0.18 and 4.1.0-RC.7, which fix the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.18 or 4.1.0-RC.7.

Thanks

The phpMyFAQ team would like to thank Offensive-AI for the responsible disclosures of this vulnerability.

Security Advisory 2026-01-23

2026-01-23T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2026-01-23
Software:: phpMyFAQ <= 4.0.16
Risk:: Moderate
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.0.16 and earlier.

Description

A logged‑in user without the permission to download files can download FAQ attachments. This is due to a permissive

permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user

logic expression.

Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup.

The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.

Several public API endpoints return email addresses and non‑public records (e.g., open questions with isVisible=false).

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 4.0.17 and 4.1.0-RC.3, which fix the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.17 or 4.1.0-RC.3.

Thanks

The phpMyFAQ team would like to thank Brahim-Fouad Guia for the responsible disclosures of these vulnerabilities.

Security Advisory 2025-12-29

2025-12-29T00:00:00Z

Stored cross-site scripting (XSS) and unauthenticated config backup download vulnerability in phpMyFAQ

Issued on:: 2025-12-29
Software:: phpMyFAQ <= 4.0.15
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.0.15 and earlier.

Description

A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an

administrator’s browser by registering a user whose display name contains HTML entities (e.g., <img ...>). When

an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting

in script execution in the admin context.

An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and

then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files

(e.g., database.php with database credentials), leading to high-impact information disclosure and potential follow-on

compromise.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 4.0.16 and 4.1.0-RC, which fix the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.15 or 4.1.0-RC.

Thanks

The phpMyFAQ team would like to thank eclipse07077 for the responsible disclosures of this vulnerability.

Security Advisory 2025-11-15

2025-11-15T00:00:00Z

Authenticated SQL Injection in Configuration Update Functionality in phpMyFAQ

Issued on:: 2025-11-15
Software:: phpMyFAQ <= 4.0.13
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that'd been discovered in phpMyFAQ 4.0.12 and

earlier.

Description

An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and

prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands.

Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all

data, as well as potential remote code execution depending on the database configuration.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.14, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.14.

Thanks

The phpMyFAQ team would like to thank Yihao Peng for the responsible disclosures of this vulnerability.

Security Advisory 2025-10-03

2025-10-03T00:00:00Z

Duplicate email registration allows multiple accounts with the same email in phpMyFAQ

Issued on:: 2025-10-03
Software:: phpMyFAQ <= 4.0.12
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that'd been discovered in phpMyFAQ 4.0.12 and

earlier. It's possible to create duplicate email registration allows multiple accounts with the same email in phpMyFAQ.

Description

Due to insufficient validation of email addresses during the user registration process,

it is possible to register multiple user accounts using the same email address.

This vulnerability can lead to confusion in user management, potential unauthorized access to user-specific features,

and complications in password recovery processes.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.13, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.13.

Thanks

The phpMyFAQ team would like to thank halas98 for the

responsible disclosures of this vulnerability.

Security Advisory 2025-01-02

2025-01-02T00:00:00Z

Stored HTML Injection vulnerability in phpMyFAQ

Issued on:: 2025-01-02
Software:: phpMyFAQ <= 4.0.0-RC.5
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issues that'd been discovered in phpMyFAQ 4.0.1 and

earlier. A stored HTML injection vulnerability has been discovered in the phpMyFAQ application.

Description

Due to insufficient validation on the content of new FAQ posts, it is possible for authenticated users to inject

malicious HTML or JavaScript code that can impact other users viewing the FAQ. This vulnerability arises when

user-provided inputs in FAQ entries are not sanitized or escaped before being rendered on the page.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.2, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.2.

Thanks

The phpMyFAQ team would like to thank geo-chen for the responsible disclosures of this vulnerability.

Security Advisory 2024-12-13

2024-12-13T00:00:00Z

User Interface (UI) Misrepresentation of Critical Information vulnerability in phpMyFAQ

Issued on:: 2024-12-06
Software:: phpMyFAQ <= 4.0.0-RC.5
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issues that'd been discovered in phpMyFAQ 4.0.0 and

earlier. A User Interface (UI) Misrepresentation of Critical Information vulnerability has been discovered in the

phpMyFAQ application.

Description

A vulnerability exists in phpMyFAQ where a privileged attacker can trigger a file download on a victim's machine upon

a page visit by embedding it in an iframe element without user interaction or explicit consent.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.1, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.1.

Thanks

The phpMyFAQ team would like to thank geo-chen for the responsible disclosures of this vulnerability.

Security Advisory 2024-12-06

2024-12-06T00:00:00Z

Information disclosure vulnerability in phpMyFAQ

Issued on:: 2024-12-06
Software:: phpMyFAQ <= 4.0.0-RC.5
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issues that'd been discovered in phpMyFAQ 4.0.0-RC.5 and

earlier. An information disclosure vulnerability has been discovered in the phpMyFAQ application.

This vulnerability reveals the database username and password if the database is not available.

Description

If the database is not available, the database username and password are shown in the error message.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.0, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 4.0.0.

Thanks

The phpMyFAQ team would like to thank geo-chen for the responsible disclosures of this vulnerability.

Security Advisory 2024-07-21

2024-07-21T00:00:00Z

Authentication Bypass in phpMyFAQ

Issued on:: 2024-07-21
Software:: phpMyFAQ <= 4.0.0-alpha.2
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issues that'd been discovered in phpMyFAQ 4.0.0-alpha.2 and

earlier. An authentication bypass has been discovered in the phpMyFAQ application.

This vulnerability allows attackers to take over accounts that do not have Two-Factor Authentication (2FA) configured.

Description

It was found that the 2FA implementation has a critical flaw.

Specifically, the "secret" field for 2FA can be left as a blank string under some conditions, including fresh installations.

The vulnerability exists in the handling of the 2FA token in the index.php and TwoFactor.php files.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.0-alpha.3, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.2.8 or phpMyFAQ 4.0.0-alpha.3.

Thanks

The phpMyFAQ team would like to thank Christian Pöschl (CODE WHITE GmbH) for the responsible disclosures of these vulnerability.

Security Advisory 2024-03-25

2024-03-25T00:00:00Z

XSS, phishing and spoofing vulnerabilities in phpMyFAQ

Issued on:: 2024-03-25
Software:: phpMyFAQ <= 3.2.5
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.2.5 and

earlier. phpMyFAQ contains cross-site scripting (XSS), SQL injection and bypass vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid a Path Traversal in attachments that allows attackers with admin

rights to upload malicious files to other locations of the web root. An attacker with admin privileges can upload an

attachment containing JS code without an extension, and the application will render it as HTML, which allows for XSS

attacks. It is possible for unauthenticated users to inject HTML code to the page which might affect other users.

Also, it requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly

added FAQ. A PostgreSQL SQL injection vulnerability has been discovered in the admin section when modifying records

due to improper escaping of the email address. By manipulating the news parameter in a POST request, an attacker with

admin rights can inject malicious JavaScript code. The category image upload function in phpmyfaq is vulnerable to

manipulation of the Content-type and lang parameters, allowing attackers with admin rights to upload malicious files

with a .php extension, potentially leading to remote code execution (RCE) on the system. The email field in phpMyFAQ's

user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's FILTER_VALIDATE_EMAIL

function, which only validates the email format, not its content. A PostgreSQL SQL injection vulnerability has been

discovered in the "Add News" functionality due to improper escaping of the email address.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.2.6, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.2.6.

References

Thanks

The phpMyFAQ team would like to thank @kevinnivekkevin for the responsible disclosures of these vulnerabilities.

Security Advisory 2024-02-05

2024-02-05T00:00:00Z

XSS, phishing and spoofing vulnerabilities in phpMyFAQ

Issued on:: 2024-02-05
Software:: phpMyFAQ <= 3.2.4
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.2.4 and

earlier. phpMyFAQ contains cross-site scripting (XSS), phishing and spoofing vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when storing on attachments filenames.

The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary

emails to a large range of targets.

phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing

case for removing another user's account.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.2.5, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.2.5.

References

Thanks

The phpMyFAQ team would like to thank @PinkDraconian and Nikko Enggaliano for the responsible disclosures of these

vulnerabilities.

Security Advisory 2023-10-27

2023-10-27T00:00:00Z

XSS and insufficient session expiration vulnerabilities in phpMyFAQ

Issued on:: 2023-10-27
Software:: phpMyFAQ <= 3.2.1
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.2.1 and

earlier. phpMyFAQ contains cross-site scripting (XSS) and insufficient session expiration vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when adding malicious content into attachments and

administration. phpMyFAQ also implemented an insufficient session expiration.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.2.2, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.2.2.

References

Thanks

The phpMyFAQ team would like to thank @nyeooo, @ngductung and Matt Zajork for the responsible disclosures of these

vulnerabilities.

Security Advisory 2023-09-21

2023-09-21T00:00:00Z

XSS and cookie vulnerabilities in phpMyFAQ

Issued on:: 2023-09-21
Software:: phpMyFAQ <= 3.1.17
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.2.0 and

earlier. phpMyFAQ contains cross-site scripting (XSS) vulnerabilities. The secure flag handling of cookies is buggy.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when adding malicious content into FAQs, configuration, user

administration, and multi-site configuration.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 3.2.1 and 3.1.18, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.2.1 or 3.1.18.

References

Thanks

The phpMyFAQ team would like to thank @hainguyen0207 and @nyeooo for the responsible disclosures of these

vulnerabilities.

Security Advisory 2023-08-27

2023-08-27T00:00:00Z

XSS and CSV injection vulnerabilities in phpMyFAQ

Issued on:: 2023-08-27
Software:: phpMyFAQ <= 3.1.16
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.1.16 and

earlier. phpMyFAQ contains cross-site scripting (XSS) vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when adding malicious content into tags and FAQs.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.17, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.17.

References

Thanks

The phpMyFAQ team would like to thank @ahmedvienna for the responsible disclosures of these vulnerabilities.

Security Advisory 2023-07-16

2023-07-16T00:00:00Z

XSS and CSV injection vulnerabilities in phpMyFAQ

Issued on:: 2023-07-16
Software:: phpMyFAQ <= 3.1.15
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.1.13 and

earlier. phpMyFAQ contains cross-site scripting (XSS) and CSV injection vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when intercepting malicious content into FAQs. Additionally

phpMyFAQ doesn't implement sufficient checks against CSV injections.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.16, which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.16.

References

Thanks

The phpMyFAQ team would like to thank @chonkysec, and @lujiefsi for the responsible disclosure of these

vulnerabilities.

Security Advisory 2023-05-17

2023-05-17T00:00:00Z

XSS vulnerabilities in phpMyFAQ

Issued on:: 2023-04-23
Software:: phpMyFAQ <= 3.1.13
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.1.13 and

earlier. phpMyFAQ contains cross-site scripting (XSS) vulnerabilities.

Description

phpMyFAQ doesn't implement sufficient checks to avoid XSS when intercepting malicious content into FAQs.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.14 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.14.

References

Thanks

The phpMyFAQ team would like to thank Mohamed Abdelhady, and H4ck3r Khoỏng for the responsible disclosure of these

vulnerabilities.

Security Advisory 2023-04-23

2023-04-23T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2023-04-23
Software:: phpMyFAQ <= 3.1.12
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that have been discovered in phpMyFAQ 3.1.12 and

earlier. phpMyFAQ contains cross-site scripting (XSS) and an email address manipulation vulnerability.

Description

phpMyFAQ does not implement sufficient checks to avoid

XSS
email address manipulation

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.13 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.13.

References

Thanks

The phpMyFAQ team would like to thank Dan Barros, Asura-N, and Aziz Hakim for the responsible disclosure of this

vulnerabilities.

Security Advisory 2023-03-20

2023-03-20T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2023-02-20
Software:: phpMyFAQ <= 3.1.11
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.11 and

earlier. phpMyFAQ contains cross-site scripting (XSS), a weak password check and a privilege escalation.

Description

phpMyFAQ does not implement sufficient checks to avoid

XSS
weak passwords
privilege escalation
Captcha bypass

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.12 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.12.

References

Thanks

The phpMyFAQ team would like to thank @ahmedvienna, @josefjku, @hatlesswizard, @tsarsecurity and @isdkrisna for the

responsible disclosure of this vulnerabilities.

Security Advisory 2023-02-12

2023-02-12T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2023-02-12
Software:: phpMyFAQ <= 3.1.10
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.10 and

earlier. phpMyFAQ contains cross-site scripting (XSS), HTML injection vulnerabilities and a weak password check.

Description

phpMyFAQ does not implement sufficient checks to avoid

a bypass to flood admin with FAQ proposals
stored XSS in questions
stored HTML injections
weak passwords

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.11 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.11.

References

Thanks

The phpMyFAQ team would like to thank @ahmedvienna and @josefjku for the responsible disclosure of this

vulnerabilities.

Security Advisory 2023-01-15

2023-01-15T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2023-01-15
Software:: phpMyFAQ <= 3.1.9
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.9 and

earlier. phpMyFAQ contains cross-site scripting (XSS) vulnerabilities and a weak password check.

Description

phpMyFAQ does not implement sufficient checks to avoid

a stored XSS in "Add new question"
a stored XSS in admin user page
a stored XSS in FAQ comments
a blind stored XSS in admin open question page
a reflected XSS in the admin backend login
stored XSS on user, category, FAQ, news and configuration admin backend
weak passwords

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.10 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.10.

References

Thanks

The phpMyFAQ team would like to thank @leminv, @uonghoangminhchau, Mohamed Abdelhady, AggressiveUser and

@baharuddinzulkifli for the responsible disclosure of this vulnerability.

Security Advisory 2022-12-11

2022-12-11T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2022-12-11
Software:: phpMyFAQ <= 3.1.8
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.8 and

earlier. phpMyFAQ contains cross-site scripting (XSS), cross-site request forgery (CSRF) and SQL injection

vulnerabilities.

Description

phpMyFAQ does not implement sufficient checks to avoid

an authenticated SQL injection when adding categories in the admin backend
a stored cross-site scripting vulnerability in the category name
a stored cross-site scripting vulnerability in the admin logging
a stored cross-site scripting vulnerability in the FAQ title
a PostgreSQL based SQL injection for the lang parameter
a SQL injection when storing an instance name in the admin backend
a SQL injection when adding attachments in the admin backend
a stored cross-site scripting vulnerability when adding users by admins
a missing "secure" flag for cookies when using TLS
a cross-site request forgery / cross-site scripting vulnerability when saving new questions
a reflected cross-site scripting vulnerability in the admin backend

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.9 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.9.

References

Thanks

The phpMyFAQ team would like to thank xanhacks, Ugnius, Abdelrhman Allam, Kiran PP and AggressiveUser for the

responsible disclosure of this vulnerability.

Security Advisory 2022-10-24

2022-10-24T00:00:00Z

CSRF vulnerability in phpMyFAQ

Issued on:: 2022-10-24
Software:: phpMyFAQ <= 3.1.7
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a multiple security issues that have been discovered in phpMyFAQ 3.1.7 and

earlier. phpMyFAQ contains a pre-auth SQL injection and cross-site scripting vulnerabilities.

Description

phpMyFAQ does not implement sufficient checks to avoid

a pre-auth SQL injection in then saving user comments
a reflected cross-site scripting vulnerability in the search
a stored cross-site scripting vulnerability in the meta data administration
a weak password requirement

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.8 which fixes these vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.8.

References

XSS (Found by Hoang Van Hiep)
XSS (Found by Hoang Van Hiep)
Weak password requirement (Found by Hoang Van Hiep)
pre-auth SQL injection (Found by Max Garrett)

Thanks

The phpMyFAQ team would like to thank Hoang Van Hiep and Max Garrett from Assetnote for the responsible disclosure of this vulnerability.

Security Advisory 2022-10-02

2022-10-02T00:00:00Z

CSRF vulnerability in phpMyFAQ

Issued on:: 2022-10-02
Software:: phpMyFAQ <= 3.1.6
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 3.1.6 and

earlier. phpMyFAQ contains a cross-site request forgery (CSRF) vulnerability.

Description

phpMyFAQ does not implement sufficient checks to avoid

CSRF when logging out an user.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.7 which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.7.

References

CSRF (Found by KhanhCM)

Thanks

The phpMyFAQ team would like to thank KhanhCM for the responsible disclosure of this vulnerability.

Security Advisory 2022-07-23

2022-07-23T00:00:00Z

Stored XSS vulnerability in phpMyFAQ

Issued on:: 2022-07-23
Software:: phpMyFAQ <= 3.1.5
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 3.1.5 and

earlier. phpMyFAQ contains a stored cross-site scripting (XSS) vulnerability.

Description

phpMyFAQ does not implement sufficient checks to avoid stored XSS when saving content in the administration

configuration

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.1.6 which fix the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.1.6.

References

XSS (Found by jhond0e)

Thanks

The phpMyFAQ teams would like to thank jhond0e for the responsible disclosure of the vulnerability.

Security Advisory 2022-01-17

2022-01-17T00:00:00Z

Multiple CSRF and XSS vulnerabilities in phpMyFAQ

Issued on:: 2022-01-17
Software:: phpMyFAQ <= 3.0.9
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of some security issues that have been discovered in phpMyFAQ 3.0.9 and

earlier. phpMyFAQ contains multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities.

Description

phpMyFAQ does not implement sufficient checks to avoid

XSS in the administration section when deleting meta data by an admin user,
CSRF when toggling open questions by an admin user,
CSRF when truncating search terms by an admin user,
CSRF when logging out an admin user.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 3.0.10 which fix the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.0.10.

References

Thanks

The phpMyFAQ teams would like to thank 0x7zed, M0rphling, justinp09010 and Dennis Yassine for the responsible

disclosure of these vulnerabilities.

Security Advisory 2021-10-22

2021-10-22T00:00:00Z

Missing DMARC record

Issued on:: 2021-10-22
Software:: phpmyfaq.de website
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in our mail server configuration, a

missing DMARC record

Description

Email spoofing was possible due to missing DMARC Records for the mail server at phpmyfaq.de. Attackers could send an

email from that exact domain put in From field, because SMTP by default does not have any protection against fake

“From” addresses.

Solution

The phpMyFAQ Team activated DMARC for our domain phpmyfaq.de.

Thanks

The phpMyFAQ teams would like to thank Jason Ryan for the responsible disclosure of the

vulnerability.

Security Advisory 2020-12-23

2020-12-23T00:00:00Z

XSS in phpMyFAQ

Issued on:: 2020-12-23
Software:: phpMyFAQ <= 3.0.6
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 3.0.6 and earlier. phpMyFAQ

contains a cross-site scripting (XSS) vulnerability.

Description

phpMyFAQ does not implement sufficient checks to avoid XSS injection for displaying tags.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 3.0.7 and 3.1.0-alpha.3 which fix the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 3.0.7 or 3.1.0-alpha.3.

Thanks

The phpMyFAQ teams would like to thank Curtis Robinson from

Florida Tech for the responsible disclosure of the

vulnerability and helping to fix it.

Security Advisory 2018-09-02

2018-09-02T00:00:00Z

Multiple vulnerabilities in phpMyFAQ

Issued on:: 2018-09-02
Software:: phpMyFAQ <= 2.9.10
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of some security issues that have been discovered in phpMyFAQ 2.9.10 and

earlier. phpMyFAQ contains cross-site request forgery, a CSV Injection and an insecure usage of microtime for

password-reset tokens.

Description

phpMyFAQ does not implement sufficient checks to avoid CSRF and CSV injection for the reports generated in the admin

backend. For the CSRF and CSV injection you need administrator privileges to be executed. We also use microtime to

generate the tokens of new passwords.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.9.11 which fix the vulnerabilities. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.9.11.

References

Thanks

The phpMyFAQ teams would like to thank Zeel Chavda for the CSRF and CSV injection. We want to thank all for the

responsible disclosure of these vulnerabilities.

Security Advisory 2017-10-19

2017-10-19T00:00:00Z

XSS, CSRF and SQL injection in phpMyFAQ

Issued on:: 2017-10-19
Software:: phpMyFAQ <= 2.9.8
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of some security issues that have been discovered in phpMyFAQ 2.9.8 and

earlier. phpMyFAQ contains cross-site request forgery, cross-site scripting and SQL injection vulnerabilities.

Description

phpMyFAQ does not implement sufficient checks to avoid XSS, CSRF and SQL injection. For the XSS and CSRF vulnerabilities

you need administrator privileges to be executed.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.9.9 which fix the vulnerabilities. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.9.9.

References

CVE-2017-14618
(reported by Ishaq Mohammed)
CVE-2017-14619
(reported by Ishaq Mohammed)
CVE-2017-15727
(reported by Nikhil Mittal)
CVE-2017-15728
(reported by Nikhil Mittal)
CVE-2017-15729
(reported by Nikhil Mittal)
CVE-2017-15730
(reported by Nikhil Mittal)
CVE-2017-15731
(reported by Nikhil Mittal)
CVE-2017-15732
(reported by Nikhil Mittal)
CVE-2017-15733
(reported by Nikhil Mittal)
CVE-2017-15734
(reported by Nikhil Mittal)
CVE-2017-15735
(reported by Nikhil Mittal)
CVE-2017-15808
(reported by Chirag Solanki)
CVE-2017-15809
(reported by Chirag Solanki)

Thanks

The phpMyFAQ teams would like to thank

Ishaq Mohammed, Nikhil Mittal and Chirag Solanki. We also like to thank Li Ke and Zhou Junyu from Tencent's Xuanwu Lab.

for the responsible disclosure of these vulnerabilities.

Security Advisory 2017-07-12

2017-07-12T00:00:00Z

Improper Restriction in phpMyFAQ

Issued on:: 2017-07-12
Software:: phpMyFAQ <= 2.9.7
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 2.9.6 and

earlier. phpMyFAQ has an improper account-lockout setting, which makes it easier for remote attackers to obtain access

via a brute-force attack.

Description

phpMyFAQ does not implement sufficient measures to prevent multiple failed authentication attempts within in a short

time frame, making it more susceptible to brute force attacks. An attacker could perform an arbitrary number of

authentication attempts using different passwords, and eventually gain access to the targeted account.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.9.8 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.9.8.

References

n/a (coming soon)

Thanks

The phpMyFAQ teams would like to thank Mishra Dhiraj for the responsible disclosure of this vulnerability.

Security Advisory 2017-04-02

2017-04-02T00:00:00Z

Stored XSS in phpMyFAQ

Issued on:: 2017-04-02
Software:: phpMyFAQ <= 2.9.6
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 2.9.6 and

earlier. phpMyFAQ contains a stored vulnerability.

Description

phpMyFAQ relies on PHPs filter_input() function with FILTER_SANITIZE_STRING flag is used to sanitize strings inside

the functionality to save new FAQs. But this function doesn’t protect against XSS.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.9.7 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.9.7.

References

CVE-2017-7579

Thanks

The phpMyFAQ teams would like to thank

Noman Shaikh for the responsible disclosure of this vulnerability.

Security Advisory 2017-01-27

2017-01-27T00:00:00Z

Execution of arbitrary PHP code in phpMyFAQ version 2.9

Issued on:: 2017-01-27
Software:: phpMyFAQ version <= 2.9.5
Risk:: critical
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our

file upload functionality in phpMyFAQ 2.9.

Description

The vulnerability is caused due to missing CSRF and file type check, which can be exploited to execute

arbitrary PHP code.

Impact

This issue allows for possible remote code execution.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.9.6 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.9.6.

Credits

The phpMyFAQ teams would like to thank Clifford Trigo from

Invalid Web Security for the

responsible disclosure of this vulnerability.

Security Advisory 2016-05-31

2016-05-31T00:00:00Z

Stored XSS in phpMyFAQ

Issued on:: 2016-05-31
Software:: phpMyFAQ <= 2.8.28 and phpMyFAQ <= 2.9.0
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 2.8.28 and 2.9.0 and

earlier. phpMyFAQ contains a stored vulnerability.

Description

phpMyFAQ relies on PHPs filter_input() function with FILTER_VALIDATE_URL flag is used to validate URLs inside the

functionality to save FAQs. But this function doesn’t protect against XSS.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.8.29 and 2.9.1 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.29 and 2.9.1.

Credits

Security Advisory by Kacper Szurek

Thanks

The phpMyFAQ teams would like to thank Kacper Szurek

for the responsible disclosure of this vulnerability.

Security Advisory 2016-04-11

2016-04-11T00:00:00Z

RCE via CSRF in phpMyFAQ

Issued on:: 2016-04-11
Software:: phpMyFAQ <= 2.8.26 and phpMyFAQ <= 2.9.0-RC2
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 2.8.26 and 2.9.0-RC2 and

earlier. phpMyFAQ contains a cross-site request forgery vulnerability.

Description

The vulnerability exists due to application does not properly verify origin of HTTP requests in "Interface

Translation" functionality. A remote unauthenticated attacker can create a specially crafted malicious web page with

CSRF exploit, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the

legitimate user, inject and execute arbitrary PHP code on the target system with privileges of the webserver.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 2.8.27 and 2.9.0-RC3 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.27 and 2.9.0-RC3.

Credits

HTB23300 Security Advisory

Thanks

The phpMyFAQ teams would like to thank High-Tech

Bridge Security Research Lab for the responsible disclosure of this vulnerability.

Security Advisory 2014-11-30

2014-11-30T00:00:00Z

Clickjacking vulnerability in phpMyFAQ 2.8

Issued on:: 2014-11-30
Software:: phpMyFAQ <= 2.8.17
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a clickjacking issue that have been discovered in phpMyFAQ

2.8.17 and earlier.

Description

phpMyFAQ 2.8.17 and earlier are vulnerable to clickjacking for all pages as it's possible to

load phpMyFAQ in an iFrame which can trick a user into performing undesired actions by

clicking on a concealed link.

Solution

The phpMyFAQ Team has released phpMyFAQ version 2.8.18 which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.18.

Thanks

The phpMyFAQ teams would like to thank

Narendra Bhati

for the responsible disclosure of this vulnerability.

Security Advisory 2014-09-16

2014-09-16T00:00:00Z

Multiple security vulnerabilities in phpMyFAQ 2.8

Issued on:: 2014-09-16
Software:: phpMyFAQ <= 2.8.12
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that have been discovered in phpMyFAQ

2.8.12 and earlier:

SQL Injection
Various Cross Site Scripting issues
Content Spoofing
Cross Site Request Forgery
Privilege Escalations
Insecure Direct Object Reference
Captcha Implementation Bypass
Persistent XSS

Description

phpMyFAQ 2.8.12 is containing a SQL Injection vulnerability through the restore

function. This functionality is only executable by admin users with special permissions.
The application containing cross site scripting and content spoofing vulnerabilities

through Flash files bundled with TinyMCE and Ajax FileManager plugins.
The bundled TinyMCE Editor (v3.5.11) containing a DOM based stored cross site scripting

vulnerability.
The "delete user" functionality of phpMyFAQ 2.8.12 is containing a CSRF vulnerability.
An attacker can delete any open question through another CSRF vulnerability because of

the lack of a CSRF token.
The check on "download an attachment" permissions is not working correct, so that anyone

can download attachments.
An admin having privilege to delete any FAQ multi-site primary instance.
The application containing an improper Captcha implementation, as a result an attacker

can replay the request to bypass the Captcha protections on forms.
Administrator is able to view information about specific user session with unfiltered

IPs and user agents.

Solution

The phpMyFAQ Team has released phpMyFAQ version 2.8.13 which fixes the vulnerabilities. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.13.

References

SQL Injection: CVE-2014-6045
CSRF issues: CVE-2014-6046
incorrect enforcement of privilege restrictions: CVE-2014-6047
Direct request to the URL of an attachment: CVE-2014-6048
Authorization bypass with a modified instance ID parameter: CVE-2014-6049
Captcha implementation bypass: CVE-2014-6050

Thanks

The phpMyFAQ teams would like to thank Nikhil Srivastava, CTO at

Techdefence Labs

and Jinen Patel for the responsible disclosure of these vulnerabilities.

Security Advisory 2014-02-04

2014-02-04T00:00:00Z

phpMyFAQ vulnerable to XSS and CSRF

Issued on:: 2014-02-04
Software:: phpMyFAQ <= 2.8.5
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of security issues that have been discovered in phpMyFAQ 2.8.5

and earlier. phpMyFAQ contains cross-site request forgery and cross-site scripting

vulnerabilities.

Description

An arbitrary script may be executed on the user's Internet Explorer when using an older

version of the browser. If a user views a malicious page while logged in, settings may be

changed unintentionally.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.8.6 which fixes thie vulnerability.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to

this latest version. Internet Explorer user are save with version 10 or later.

Workaround

There's no workaround except installing phpMyFAQ 2.8.6.

Credits

Thanks

The phpMyFAQ teams would like to thank

JPCERT Coordination Center for the responsible disclosure of this vulnerability.

Security Advisory 2013-11-18

2013-11-26T00:00:00Z

Possible arbitrary PHP code execution vulnerability

Issued on:: 2013-11-26
Software:: phpMyFAQ <= 2.8.3
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ

2.8.x.

Description

Secunia noticed while analysing the advisory that authenticated users with "Right to add

attachments" are able to exploit an already publicly known issue in the bundled Ajax File

Manager of phpMyFAQ version 2.8.3, which leads to arbitrary PHP code execution for

authenticated users with the permission "Right to add attachments".

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.8.4 which fixes thie vulnerability.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to

this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.3.

Credits

Please check this advisory for further

information about the publicly known issue in the bundled Ajax File Manager.

Thanks

The phpMyFAQ teams would like to thank Secunia for the

responsible disclosure of this vulnerability.

Security Advisory 2013-11-18

2013-11-18T00:00:00Z

Permission vulnerability

Issued on:: 2013-11-18
Software:: phpMyFAQ <= 2.8.2
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ

2.8.x.

Description

phpMyFAQ 2.8.x allows logged in users without any proper permissions the usage of the

bundled Image Manager.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.8.3 which fixes thie vulnerability.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to

this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.8.3.

Credits

Please check

http://pastebin.com/tmYXh6XM for further information.

Security Advisory 2012-04-14

2012-04-14T00:00:00Z

Remote PHP Code Execution Vulnerability in phpMyFAQ 2.7.4 and earlier

Issued on:: 2012-04-14
Software:: phpMyFAQ <= 2.7.4
Risk:: Critical
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our

bundled ImageManager library we use in phpMyFAQ 2.7.

Description

The bundled ImageManager library allows injection of arbitrary PHP code to execute arbitrary PHP

code and upload malware and trojan horses.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.7.5, which incorporates a fixed bundled

ImageManager library. All users of affected phpMyFAQ versions are encouraged to upgrade as soon

as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.7.5.

Credits

The phpMyFAQ Team would like to thank EgiX for discovering this vulnerability.

Security Advisory 2011-10-25

2011-10-25T00:00:00Z

Remote PHP Code Injection Vulnerability in phpMyFAQ 2.6.18 and 2.7.0

Issued on:: 2011-11-25
Software:: phpMyFAQ <= 2.6.18 and phpMyFAQ <= 2.7.0
Risk:: Critical
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our

bundled ImageManager library we use in phpMyFAQ 2.6 and 2.7.

Description

The bundled ImageManager library allows injection of arbitrary PHP code via POST requests.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.6.19 and 2.7.1, which incorporates a

fixed bundled ImageManager library. All users of affected phpMyFAQ versions are encouraged to

upgrade as soon as possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.6.19 and phpMyFAQ 2.7.1.

Credits

The phpMyFAQ Team would like to thank EgiX for discovering this vulnerability.

Security Advisory 2011-09-28

2011-09-28T00:00:00Z

Information disclosure vulnerability

Issued on:: 2011-09-28
Software:: phpMyFAQ <= 2.6.17
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.6.

Description

phpMyFAQ 2.6 allows remote attackers to obtain sensitive information via a direct request to a

.php file, which reveals the installation path in an error message, e.g. by lang/language_uk.php

and certain other files.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.6.18 which fixes these vulnerabilities.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.6.18.

Credits

Please check

CVE-2011-3783 for further information.

Security Advisory 2010-12-15

2010-12-15T00:00:00Z

phpmyfaq.de compromised

Issued on:: 2010-12-15
Software:: phpMyFAQ > 2.6.10
Risk:: Critical
Platforms:: all

The main server of the phpMyFAQ Project was compromised in an attack, allowing a rogue version

of the phpMyfAQ software to be uploaded and distributed from december 4th until december 15th.

The affected versions were phpMyFAQ 2.6.11 and 2.6.12, both zip and tar.gz package. The attacker

also changed the MD5 files.

Description

The attacker added a backdoor into the file inc/Faq.php in the method getTopTen(). The code was

base64 encoded and first sent an e-mail to a GMail address and added an entry in the faqconfig

table. With this entry, a backdoor was opened to include to include arbitrary PHP code.

Solution

The phpMyFAQ Team will release a new clean phpMyFAQ version 2.6.13. All users of affected

phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

Workaround

If you use phpMyFAQ 2.6.11 or phpMyFAQ 2.6.12 downloaded after december 4th or before december

15th you should change the file inc/Faq.php as soon as possible.

Security Advisory 2010-09-28

2010-09-28T00:00:00Z

phpMyFAQ 2.6.x XSS vulnerabilities

Issued on:: 2010-09-28
Software:: phpMyFAQ <= 2.6.8
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that have been discovered in phpMyFAQ 2.6.x

Description

phpMyFAQ doesn't sanitize some variables in different pages correctly. With a properly crafted

URL it is e.g. possible to inject JavaScript code into the output of a page, which could result

in the leakage of domain cookies (f.e. session identifiers).

Solution

The phpMyFAQ Team has released new phpMyFAQ version 2.6.9 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest

version.

Workaround

There's no workaround except installing phpMyFAQ 2.6.9.

Credits

The phpMyFAQ Team would like to thank Yam Mesicka for reporting the vulnerability.

Security Advisory 2009-12-01

2009-12-01T00:00:00Z

phpMyFAQ 2.5.x XSS vulnerabilities

Issued on:: 2009-12-01
Software:: phpMyFAQ <= 2.5.4
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of multiple security issues that have been discovered in phpMyFAQ

2.5.x

Description

When using Microsoft Internet Explorer 6 or 7 phpMyFAQ doesn't sanitize various variables in

different pages correctly. With a properly crafted URL it is e.g. possible to inject JavaScript

code into the output of a page, which could result in the leakage of domain cookies (f.e.

session identifiers).

Solution

The phpMyFAQ Team has released new phpMyFAQ version 2.5.5 which fix the vulnerability. All users

of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest

version.

Workaround

There's no workaround except installing phpMyFAQ 2.5.5.

Credits

The phpMyFAQ Team would like to thank Amol Naik for reporting the vulnerability.

Security Advisory 2009-09-01

2009-09-01T00:00:00Z

phpMyFAQ 2.0.x XSS vulnerability

Issued on:: 2009-09-01
Software:: phpMyFAQ <= 2.5.1
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.x

Description

When using Microsoft Internet Explorer 6 or 7 phpMyFAQ doesn't sanitize a GET variable in the

search page correctly. With a properly crafted URL it is f.e. possible to inject HTML code into

the output of the error message, which could result in the leakage of domain cookies (f.e.

session identifiers).

Solution

The phpMyFAQ Team has released new phpMyFAQ versions 2.0.17 and 2.5.2 which fix the

vulnerability. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as

possible to this latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.0.17 or 2.5.2.

Credits

The phpMyFAQ Team would like to thank Or Katz from

Breach Security and Yair

Lapin from the Hebrew University

of Jerusalem for reporting the vulnerability.

Security Advisory 2009-06-02

2009-06-02T00:00:00Z

phpMyFAQ 2.0.x XSS vulnerability

Issued on:: 2009-06-02
Software:: phpMyFAQ <= 2.0.14
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.0.

Description

phpMyFAQ doesn't sanitize the error message in the admin login page. In case of a "bad login"

attempt with a properly crafted URL it is f.e. possible to inject HTML code into the output of

the error message, which could result in the leakage of domain cookies (f.e. session

identifiers).

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.0.15 which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest

version.

Workaround

There's no workaround except installing phpMyFAQ 2.0.15.

Credits

The phpMyFAQ Team would like to thank Jan Hertsens and Rick G. Elliot (LiveOps Inc) for

reporting the vulnerability.

Security Advisory 2008-09-11

2008-09-11T00:00:00Z

phpMyFAQ 2.x input sanitization errors (XSS)

Issued on:: 2008-09-11
Software:: phpMyFAQ <= 2.0.8
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.0.

Description

phpMyFAQ relies on code similar to Popoon's externalinput.php to filter out potential XSS

attacks on user-supplied input. This filter, and the original, fail to fully sanitize user data.

In particular, this filter fails to protect against '/'s acting as spaces in both Microsoft

Internet Explorer and Mozilla Firefox.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 2.0.8 which fixes these vulnerabilities.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 2.0.8.

Credits

Vulnerability report and proof of concepts by Alexios Fakos. Thanks to Will Drewry for

contacting the phpMyFAQ Team. The full advisory can be found

here.

Security Advisory 2007-02-18

2007-02-18T00:00:00Z

Remote code execution vulnerability in phpMyFAQ 1.6.x

Issued on:: 2007-02-18
Software:: phpMyFAQ <= 1.6.9
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned about a vulnerability in the code that could be exploited in

phpMyFAQ 1.6.x.

Description

Through the vulnerability it is possible to gain the privilege for uploading files on the server

when register_globals is activated: currently no public exploit is available but some users

already reported us to be hacked and the r57shell script has been installed on

their systems.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 1.6.10 which fixes the vulnerability.

All users of the affected phpMyFAQ versions are encouraged to upgrade as soon as possible to

this latest version.

Workaround

If it's possible for you set register_globals to off in your php.ini configuration settings.

Credits

The phpMyFAQ Team would like to thank François Maillet and Enrico Fischer (Powerserver-Germany

webHosting & DomainServices) for reporting the vulnerability, and Johannes Schlüter for

discovering and fixing the issue.

Security Advisory 2006-12-15

2006-12-15T00:00:00Z

SQL injection and remote code execution vulnerabilities in phpMyFAQ 1.6.x

Issued on:: 2006-12-15
Software:: phpMyFAQ <= 1.6.7
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned about some vulnerabilities in the code that could be exploited in

phpMyFAQ 1.6.x.

Description

Through one of the vulnerabilities it is possible to gain the privilege for uploading files on

the server: currently no public exploit is available but two users already reported us to be

hacked and the r57shell script has been installed on their systems.

Solution

The phpMyFAQ Team has released the new phpMyFAQ version 1.6.8 which fixes these vulnerabilities.

All users of the affected phpMyFAQ versions are encouraged to upgrade as soon as possible to

this latest version.

Workaround

At the time of this advisory there's no workaround except installing phpMyFAQ 1.6.8.

Credits

The phpMyFAQ Team would like to thank Markus Kohlmeyer, for reporting us how his system has been

hacked, and Stefan Esser, for discovering all the other vulnerabilities.

Security Advisory 2006-04-21

2006-04-21T00:00:00Z

Memory leak vulnerability in phpMyFAQ 1.5.x / 1.6.x

Issued on:: 2006-04-21
Software:: phpMyFAQ <= 1.5.8 and phpMyFAQ <= 1.6.0 RC2
Risk:: Medium
Platforms:: all

The phpMyFAQ Team has learned about a vulnerability in PHP that can be exploited in phpMyFAQ

1.5.x and phpMyFAQ 1.6.x RC2.

Description

A binary safety issue in the PHP function html_entity_decode() can leak memory content.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 1.5.9 and phpMyFAQ 1.6.0 which fix

these vulnerability. All users of affected phpMyFAQ versions are encouraged to upgrade as soon

as possible to this latest version.

Workaround

If it's possible you should upgrade your PHP version to 4.4.3 or 5.1.3 which also fixes the

problem.

Credits

The phpMyFAQ Team would like to thank Tõnu Samuel for discovering this vulnerability.

Security Advisory 2005-11-18

2005-11-18T00:00:00Z

Multiple Cross Site Scripting vulnerabilities in phpMyFAQ 1.5.x

Issued on:: 2005-11-18
Software:: phpMyFAQ <= 1.5.3
Risk:: High
Platforms:: all

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 1.5.

Description

All vulnerabilities are exploitable by an anonymous user. All vulnerabilities are exploitable,

no matter if magic_quotes_gpc is turned on or off. The "thema", "username" and "usermail"

parameters are prone to cross-site scripting attacks in the "add content" page.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.5.4 which fixes these vulnerabilities.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 1.5.4.

Credits

The phpMyFAQ Team would like to thank Tobias Klein for discovering these vulnerabilities. Tobias

Klein has also released an

independent advisory, describing the vulnerability in more detail.

Security Advisory 2005-09-23

2005-09-23T00:00:00Z

SQL injection, takeover, path disclosure, remote code execution in phpMyFAQ 1.5.x

Issued on:: 2005-09-23
Software:: phpMyFAQ <= 1.5.2
Risk:: critical
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in phpMyFAQ 1.5.

Description

If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible

to overwrite the admin password and to take over the whole system. In some files in the admin

section there are some cross site scripting vulnerabilities. In the public frontend it's

possible to include arbitrary PHP files.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.5.2 which fixes these vulnerabilities.

All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this

latest version.

Workaround

There's no workaround except installing phpMyFAQ 1.5.2.

Credits

Thanks to Christian Ney for the hint about the public exploit.

We would like to put emphasis on the disappointment we feel when a bugreporter does not contact

the authors of a software first, before posting any exploits. The common way to report this, is

to give the developers a reasonable amount of time to respond to an exploit before it is made

public.

Security Advisory 2005-08-15

2005-08-15T00:00:00Z

Remote PHP Code Injection Vulnerability in phpMyFAQ 1.4.x and 1.5.x

Issued on:: 2005-08-15
Software:: phpMyFAQ <= 1.4.10 and phpMyFAQ <= 1.5.0 RC6
Risk:: high
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our

bundled library XML-RPC we use in phpMyFAQ 1.4 and 1.5.

Description

The bundled XML-RPC library allow injection of arbitrary PHP code into eval() statements. This

is caused by an improper handling of XMLRPC requests and responses that are malformed in a

certain way.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.4.11 and 1.5.0 RC7, which incorporate a

fixed bundled library XML-RPC. All users of affected phpMyFAQ versions are encouraged to upgrade

as soon as possible to this latest version.

Workaround

As a temporary hotfix you can delete your xmlrpc.php and xmlrpcs.php file in the directory inc/

so that your FAQ will not easily allow execution of maliclius XML-RPC method calls.

Credits

The phpMyFAQ Team would like to thank Stefan Esser and the

Hardened-PHP Project

for discovering this vulnerability. The Hardened-PHP Project has also released a

more detailed advisory.

Security Advisory 2005-03-06

2005-06-29T00:00:00Z

Execution of arbitrary PHP code in phpMyFAQ version 1.4 and 1.5

Issued on:: 2005-06-29
Software:: phpMyFAQ version 1.4 and 1.5
Risk:: high
Platforms:: all

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our

bundled library XML-RPC we use in phpMyFAQ 1.4 and 1.5.

Description

The vulnerability is caused due to an unspecified error, which can be exploited to execute

arbitrary PHP code via an application using the vulnerable library.

Impact

This issue allows for possible remote code execution.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.4.9 and 1.5.0 RC5, which incorporate

a fixed bundled library XML-RPC. All users of affected phpMyFAQ versions are encouraged to

upgrade as soon as possible to this latest version.

Workaround

As a temporary hotfix you can delete your xmlrpcs.php and xmlrpcs.php file in the directory

inc/ so that your FAQ will not easily allow execution of maliclius XML-RPC method calls.

Credits

Please read this advisory, too.

Security Advisory 2005-03-06

2005-03-06T00:00:00Z

SQL injection vulnerability in phpMyFAQ version 1.4 and 1.5

Issued on:: 2005-03-06
Software:: phpMyFAQ version 1.4 and 1.5
Risk:: medium
Platforms:: all

The phpMyFAQ Team has learned of a possible SQL injection vulnerability in phpMyFAQ version 1.4

and 1.5.

Description

phpMyFAQ lets public users add FAQ records to the database. The records will be saved into the

database but aren't visible by default.

Impact

Input passed to the username field in forum messages isn't properly sanitised before being

stored.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.4.7 and 1.5.0 RC2, which incorporate a

fix for the SQL injection vulnerability. All users of affected phpMyFAQ versions are encouraged

to upgrade to this latest version.

Workaround

There is no workaround except installing the new version.

Credits

The phpMyFAQ Team would like to thank Sven Michels of sectoor GmbH for discovering this SQL

injection vulnerability.

Security Advisory 2004-07-27

2004-07-27T00:00:00Z

Vulnerability in phpMyFAQ version 1.4.0

Issued on:: 2004-07-27
Software:: phpMyFAQ version 1.4.0
Risk:: medium
Platforms:: all

The phpMyFAQ Team has learned of a security vulnerability in phpMyFAQ version 1.4.0.

Description

phpMyFAQ includes a third party Image Manager for uploading images. The Image Manager can be

accessed by anyone on the web without authorization.

Impact

The Image Manager can be accessed by typing the location of the Image Manager and this person

can upload images on your page or delete all images.

Solution

The phpMyFAQ Team has released a new phpMyFAQ version 1.4.0a, which incorporate a fix for the

vulnerability. All users of affected phpMyFAQ versions are encouraged to upgrade to this latest

version.

Workaround

There is no workaround except installing the patch.

Security Advisory 2004-05-18

2004-05-18T00:00:00Z

Vulnerabilities in phpMyFAQ versions 1.2.x, 1.3.x and 1.4.0

Issued on:: 2004-05-18
Software:: phpMyFAQ versions 1.2.x, 1.3.x and 1.4.0 alpha1
Risk:: medium
Platforms:: all

The phpMyFAQ Team has learned of security vulnerabilities in phpMyFAQ versions 1.2.x, 1.3.x, and 1.4.0 alpha1.

Description

phpMyFAQ includes template files and due to insufficient checking of the variables, there is a possibility for inclusion

of arbitrary local files when using phpMyFAQ with PHP as Apache module and an incorrectly set open_basedir directive.

Impact

Both local and remote users may exploit these vulnerabilities to compromise the web server and, under certain

conditions, to gain privileged access. An intruder may be able to execute arbitrary code with the privileges of the web

server. These vulnerabilities may be exploited to compromise the web server and, under certain conditions, to gain

privileged access.

Solution

The phpMyFAQ Team has released new phpMyFAQ versions, 1.3.13 and 1.4.0 alpha2, which incorporate a fix for the

vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade to this latest version. A patch for

the unsupported phpMyFAQ 1.2.x versions is available too.

Workaround

These vulnerabilities shouldn't work when the open_basedir directive in the php.ini file is set correctly. The

magic_quotes_gpc directive should be enabled by default on most systems since it's the default for PHP and most

well-known distributions.

Credits

The phpMyFAQ Team would like to thank Stefan Esser of e-matters GmbH for discovering this vulnerability. e-matters GmbH

has also released an independent advisory, describing the vulnerability in more detail.

Another thanks to Sven Michels (sectoor GmbH) for working out that magic_quotes_gpc turned on will prevent at least the

vulnerability in the stable version.