CVE-2024-29196: phpmyfaq/phpmyfaq - Path Traversal in Attachments

Background

phpmyfaq/phpmyfaq is a package available on Packagist that provides a frequently asked questions (FAQ) system for websites. It allows administrators to manage and display FAQs on their websites, including the ability to upload attachments to the FAQs. This vulnerability specifically affects the attachment functionality of phpmyfaq/phpmyfaq.

Vulnerability Detail

A Path Traversal vulnerability exists in the Attachments feature of phpmyfaq/phpmyfaq. Attackers with admin rights can exploit this vulnerability to upload malicious files to arbitrary locations within the web root. By manipulating the attachment location setting, an attacker can traverse directories and upload files outside of the intended directory. This can lead to potential remote code execution or unauthorized access to sensitive files.

composer require phpmyfaq/phpmyfaq:3.2.6

Workaround

As a temporary workaround, users can manually validate the attachment file path before allowing the upload. This can be done by checking if the specified path is within the intended directory and rejecting any paths that contain directory traversal characters. Here is an example of how to perform this validation in PHP:

$attachmentPath = $_POST['attachment_path'];
$intendedDirectory = '/path/to/intended/directory';

if (strpos($attachmentPath, '..') === false && strpos($attachmentPath, $intendedDirectory) === 0) {
    // Proceed with the attachment upload
} else {
    // Reject the attachment
}

Conclusion

The Path Traversal vulnerability in phpmyfaq/phpmyfaq Attachments allows attackers with admin rights to upload malicious files to arbitrary locations within the web root. Upgrading to version 3.2.6 or later of phpmyfaq/phpmyfaq is recommended to fix this vulnerability. In the meantime, users can implement the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for phpmyfaq/phpmyfaq →

FAQ