Privilege Escalation in phpMyFAQ via Category Restrictions

Executive Summary

This is a privilege escalation vulnerability in phpMyFAQ versions 4.2.0-alpha up to but not including 4.2.0-beta. It allows delegated administrators to assign categories outside their permitted scope by exploiting the GroupController::saveCategoryRestrictions() function. Specifically, they can send POST requests to /admin/api/group/category-restrictions with empty or out-of-scope category IDs, granting groups unrestricted category access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to the /admin/api/group/category-restrictions endpoint in phpMyFAQ. Check for requests with empty or out-of-scope category IDs sent by delegated administrators. Review server logs for unauthorized category access attempts or privilege changes.

Useful 0 Not Useful 0

Impact Analysis

An attacker with delegated administrator privileges could escalate their permissions to access restricted categories, potentially viewing or modifying sensitive data. This could lead to unauthorized access to confidential information, data breaches, or further system compromise depending on the exposed categories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls, potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.2.0-beta or later. If upgrading is not possible, restrict access to the /admin/api/group/category-restrictions endpoint and implement input validation to reject empty or out-of-scope category IDs. Review all group category permissions for unauthorized changes.

Useful 0 Not Useful 0