Privilege Escalation in phpMyFAQ via SuperAdmin Account Creation

Executive Summary

This vulnerability is a privilege escalation flaw in phpMyFAQ versions before 4.1.5. It allows non-SuperAdmin administrators with USER_ADD/EDIT/DELETE permissions to create a new SuperAdmin account by exploiting the user/add API endpoint. The attacker sends a crafted POST request to /admin/api/user/add with isSuperAdmin set to true and attacker-chosen credentials. This bypasses intended role separation and grants full control over the phpMyFAQ instance.

Useful 0 Not Useful 0

Impact Analysis

An attacker can gain full control of your phpMyFAQ instance, including access to all users, configurations, content, and backups. This could lead to data theft, unauthorized modifications, or complete system takeover. The impact is severe as it undermines the intended administrative role separation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy. GDPR and HIPAA mandate strict access controls and data protection measures. A breach could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Detection Guidance

Check phpMyFAQ logs for POST requests to /admin/api/user/add with isSuperAdmin=true. Monitor for new SuperAdmin accounts created by non-SuperAdmin users. Review user management API calls for unauthorized privilege escalation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.5 or later immediately. Review all user accounts for unauthorized SuperAdmin creations. Implement strict access controls for the /admin/api/user/add endpoint. Monitor for suspicious API activity.

Useful 0 Not Useful 0