Executive Summary

This vulnerability in phpMyFAQ version 4.0.16 and below involves multiple public API endpoints that improperly expose sensitive user information due to insufficient access controls. Specifically, the OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, which returns records marked as non-public (isVisible=false) along with user email addresses. Similar exposures occur in comment, news, and FAQ APIs. This leads to unintended disclosure of private content and user email addresses. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive user information such as email addresses and private content that was meant to be hidden. Attackers could harvest these email addresses for phishing campaigns or scrape confidential data, leading to privacy breaches and potential targeted attacks. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending requests to the public API endpoints of phpMyFAQ version 4.0.16 or below, specifically the open-questions API endpoint (OpenQuestionController::list()). If the response includes non-public records (isVisible=false) and user email addresses, the system is vulnerable. A simple detection command could be a curl request like: curl -X GET https://your-phpmyfaq-domain/api/open-questions and inspecting the response for sensitive data exposure. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade phpMyFAQ to version 4.0.17 or later, where the issue has been fixed. Until the upgrade is applied, restrict access to the affected API endpoints or implement additional access controls to prevent unauthorized data exposure. [1]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes improper exposure of sensitive user information, including email addresses and non-public content, which constitutes a privacy breach. Such exposure could lead to violations of data protection regulations like GDPR or HIPAA by failing to adequately protect personal data and confidential information. Attackers could exploit this to harvest emails for phishing or access private content, increasing the risk of non-compliance with privacy and data security requirements. [1]

Useful 0 Not Useful 0