Information Disclosure in phpMyFAQ via OpenQuestionController

Executive Summary

This vulnerability is an information disclosure flaw in phpMyFAQ versions 4.2.0-alpha up to but not including 4.2.0-beta. It allows unauthenticated attackers to read hidden open questions due to an inverted check in the OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ instance is running a vulnerable version (4.2.0-alpha before 4.2.0-beta). Send an unauthenticated GET request to the /api/v4.0/open-questions endpoint and verify if hidden questions marked as non-public are returned. Example command: curl -X GET http://<target>/api/v4.0/open-questions

If the response includes questions with is_visible = N or internal moderation content, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose sensitive internal or moderation questions and usernames to unauthorized users. Attackers can access hidden content without authentication, potentially leading to data leaks or misuse of confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized access to sensitive information. It exposes hidden moderation or internal questions and associated usernames via an unauthenticated API endpoint, which may include personal or confidential data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.2.0-beta or later, as this patch fixes the inverted api.onlyPublicQuestions check in OpenQuestionController.

If upgrading is not immediately possible, restrict access to the /api/v4.0/open-questions endpoint via network-level controls or web application firewall rules.

Useful 0 Not Useful 0