CVE-2024-54141: phpMyFAQ Database Credential Exposure Due to Connection Failure
Summary
CVE-2024-54141: Exposure of database (ie postgreSQL) server's credential when connection to DB fails. Affects thorsten/phpmyfaq versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyFAQ is an open-source FAQ management system designed to help users create and manage FAQs for their applications or websites. It supports various database systems, including PostgreSQL, and is widely used for its ease of use and flexibility. However, it has a vulnerability that exposes sensitive database credentials when the application fails to connect to the database server, potentially allowing unauthorized access to the database.
Vulnerability Detail
The vulnerability arises when phpMyFAQ attempts to connect to a PostgreSQL database server that is unavailable. In such cases, the application generates an error message that includes sensitive database credentials. This exposure occurs in the Installer.php file, specifically at line 694, where the connection attempt is made. If the database server is down or unreachable, the error message reveals the database username and password, which can be exploited by attackers to gain unauthorized access to the database. The severity of this vulnerability is rated high, with a CVSS score of 8.6, indicating a significant risk to the security of the database and the application.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
composer require thorsten/phpmyfaq:4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the error handling in the phpMyFAQ code to suppress detailed error messages that include sensitive information. This can be done by wrapping the connection code in a try-catch block and logging the error instead of displaying it to the user. For example:
try {
$this->conn = pg_connect($connection_string);
} catch (Exception $e) {
error_log('Database connection failed: ' . $e->getMessage());
// Display a generic error message to the user
echo 'Database connection failed. Please try again later.';
}
Conclusion
In summary, CVE-2024-54141 is a significant vulnerability in phpMyFAQ that can lead to the exposure of sensitive database credentials. It is crucial for users of phpMyFAQ to update to the latest version to protect their applications from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for thorsten/phpmyfaq →
FAQ
CVE-2024-54141 is a vulnerability in phpMyFAQ that exposes sensitive database credentials when the application fails to connect to the PostgreSQL database server.
If your application uses phpMyFAQ and is affected by this vulnerability, attackers could gain access to your database by exploiting the exposed credentials.
You should update your phpMyFAQ installation to version 4.0.0 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for thorsten/phpmyfaq.
