CVE-2024-28105: phpmyfaq/phpmyfaq - File Upload Bypass at Category Image Leads to RCE
Summary
CVE-2024-28105: phpMyFAQ's File Upload Bypass at Category Image Leads to RCE. Affects phpmyfaq/phpmyfaq versions >= 3.2.5, < 3.2.6. Fixed in 3.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpmyfaq/phpmyfaq is an open-source FAQ management system written in PHP. It provides a platform for creating and managing frequently asked questions on websites. The category image upload function in phpmyfaq is vulnerable to manipulation of the Content-type and lang parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system.
Vulnerability Detail
The vulnerability in phpmyfaq arises from the category image upload function. By manipulating the Content-type and lang parameters, an attacker can upload a file with a .php extension. This allows the attacker to upload web shells or other malicious files, which can then be executed on the system. The impact of this vulnerability is significant, as it enables attackers to execute arbitrary commands, steal sensitive data, disrupt services, and potentially escalate their privileges.
How To Fix
Minimum fixed version
3.2.6
This is the first release that contains the fix.
composer require phpmyfaq/phpmyfaq:3.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable the category image upload functionality or implement strict file type validation on the server side. This can be achieved by checking the file extension and content type against a whitelist of allowed image formats.
Conclusion
The category image upload function in phpmyfaq is vulnerable to file upload bypass, allowing attackers to upload malicious files with a .php extension and potentially achieve remote code execution. It is crucial to update to phpmyfaq version 3.2.6 or later to fix this vulnerability. If immediate update is not possible, implementing strict file type validation or disabling the category image upload functionality can serve as temporary workarounds. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
The vulnerability allows attackers to upload malicious files and execute arbitrary commands on the system, potentially leading to data theft, service disruption, and privilege escalation.
To mitigate this vulnerability, update phpmyfaq to version 3.2.6 or later. If immediate update is not possible, disable the category image upload functionality or implement strict file type validation on the server side.
Yes, a temporary workaround is to disable the category image upload functionality or implement strict file type validation on the server side.
There are no known public exploits available for this vulnerability at the moment.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
