Authentication Bypass in phpMyFAQ via LDAP

Executive Summary

This vulnerability affects phpMyFAQ versions 3.1.0 through 4.1.6. When LDAP authentication is enabled, the system unconditionally reactivates locally blocked accounts after a successful LDAP bind. The AuthLdap::create() function sets the account status to 'active' without checking if the account was previously blocked, bypassing administrative restrictions. No log entry is created for this state change, making it undetectable by administrators.

The issue occurs because the code overwrites the account_status column from 'blocked' to 'active' after an LDAP bind, even for existing users. This allows previously blocked users to regain access using valid LDAP credentials.

Useful 0 Not Useful 0

Detection Guidance

Check phpMyFAQ logs for unexpected account status changes from 'blocked' to 'active' without corresponding admin actions. Review LDAP authentication logs for successful binds by users previously blocked in phpMyFAQ. Inspect database for account_status changes in the faq_users table during LDAP authentication events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid LDAP credentials to bypass account blocks imposed by administrators. Blocked users can regain access to phpMyFAQ without detection, potentially leading to unauthorized access to sensitive data or system functions. The lack of logging means administrators cannot track these reactivations.

The impact includes unauthorized account reactivation, potential data exposure, and compromised system integrity. Since the vulnerability has a high CVSS score (8.2-8.8), it poses significant risk to affected deployments using LDAP authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate proper user access controls and audit logging. GDPR requires data protection and user access management, while HIPAA mandates audit controls for protected health information. The lack of logging for account reactivations undermines these requirements.

Organizations using affected phpMyFAQ versions may face compliance violations due to unauthorized account access and insufficient logging. Administrators cannot demonstrate proper access control enforcement or audit trail maintenance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.7 or later immediately. Disable LDAP authentication if not required. Review all user accounts for unauthorized reactivations. Implement additional logging for account status changes. Consider revoking LDAP access for previously blocked users until patched.

Useful 0 Not Useful 0