thorsten phpMyFAQ up to 3.2.4 authorization

Summaryinfo

A vulnerability classified as critical was found in thorsten phpMyFAQ up to 3.2.4. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to authorization. This vulnerability appears as CVE-2024-22208. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in thorsten phpMyFAQ up to 3.2.4 (Content Management System) and classified as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect integrity, and availability. CVE summarizes:

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.

The weakness was presented 02/06/2024 as GHSA-9hhf-xmcw-r3xg. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-22208 since 01/08/2024. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.2.5 eliminates this vulnerability. Applying the patch a34d94ab7b1be9256a9ef898f18ea6bfb63f6f1e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• thorsten

Name

• phpMyFAQ

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4

License

• open-source

Website

• Product: https://github.com/thorsten/phpMyFAQ/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion