CVE-2024-28107: phpmyfaq/phpmyfaq - phpMyFAQ SQL injections at insertentry & saveentry
Summary
CVE-2024-28107: phpMyFAQ SQL injections at insertentry & saveentry. Affects phpmyfaq/phpmyfaq versions >= 3.2.5, < 3.2.6. Fixed in 3.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The phpmyfaq/phpmyfaq package is an open-source FAQ (Frequently Asked Questions) management system written in PHP. It provides a user-friendly interface for managing and organizing FAQs on websites. The package allows authenticated users with the necessary privileges to add or edit FAQ news. However, a vulnerability has been discovered in the 'insertentry' and 'saveentry' functions, which are responsible for modifying records. This vulnerability arises due to improper escaping of the email address parameter, allowing for SQL injection attacks.
Vulnerability Detail
The SQL injection vulnerability in phpmyfaq/phpmyfaq allows authenticated users to execute malicious SQL queries. By manipulating the email and notes parameters in the 'insertentry' and 'saveentry' functions, an attacker can exfiltrate data, take over accounts, and potentially achieve remote code execution. This vulnerability can be exploited to read sensitive information from the database, compromise system integrity and confidentiality, and gain unauthorized access to user accounts or execute arbitrary commands on the server.
How To Fix
Minimum fixed version
3.2.6
This is the first release that contains the fix.
composer require phpmyfaq/phpmyfaq:3.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of the phpmyfaq/phpmyfaq package.
Conclusion
The phpmyfaq/phpmyfaq package is vulnerable to SQL injections in the 'insertentry' and 'saveentry' functions. This can be exploited by authenticated users to execute malicious SQL queries, potentially leading to data exfiltration, account takeover, and remote code execution. It is recommended to upgrade to version 3.2.6 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
The vulnerability allows authenticated users to execute malicious SQL queries, potentially leading to data exfiltration, account takeover, and even remote code execution. It compromises the confidentiality and integrity of the system and can result in unauthorized access to user accounts or execution of arbitrary commands on the server.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
While specific exploits for this vulnerability have not been disclosed, the SQL injection nature of the vulnerability allows attackers to execute arbitrary SQL queries. This can lead to various forms of exploitation, including data exfiltration, account takeover, and remote code execution.
Yes, a fix has been released in version 3.2.6 of the phpmyfaq/phpmyfaq package. It is recommended to upgrade to this version or later to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to the patched version of the phpmyfaq/phpmyfaq package.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
