Description
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpmyfaq | < 4.1.2 | 4.1.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | < 4.1.2 | 4.1.2 | GHSA-hpgw-ww76-c68r |
| Packagist | thorsten/phpmyfaq | < 4.1.2 | 4.1.2 | GHSA-hpgw-ww76-c68r |
References
- GitHub Security Advisory (GHSA-hpgw-ww76-c68r) vendor-advisory
- VulnCheck Advisory: phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check third-party-advisory