| Package | Affected versions | Patched versions |
|---|---|---|
| phpmyfaq/phpmyfaq | < 4.0.17 | 4.0.17 |
| thorsten/phpmyfaq | < 4.0.17 | 4.0.17 |
| phpmyfaq | < 4.0.17 | 4.0.17 |
Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.
SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.
Precondition: API enabled, any authenticated non‑admin user.
curl -c /tmp/pmf_api_cookies.txt \
-H 'Content-Type: application/json' \
-d '{"username":"tester","password":"Test1234!"}' \
http://192.168.40.16/phpmyfaq/api/v3.0/login
curl -i -b /tmp/pmf_api_cookies.txt \
-X POST --data '4.0.16' \
http://192.168.40.16/phpmyfaq/api/setup/backup
Low‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free