phpMyFAQ Missing Authorization Lets Users Delete Superadmin Accounts

Executive Summary

phpMyFAQ before version 4.1.9 has a missing authorization vulnerability in the deleteUser() API. This allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts by sending a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1. The issue occurs because deleteUser() checks if the current account is protected and if the target ID is 1 but does not verify if the target user is a superadmin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /admin/api/user/delete with non-superadmin accounts. Check logs for requests where userId is not 1, as this indicates potential exploitation. Use tools like Wireshark or tcpdump to capture and analyze traffic to the phpMyFAQ admin API endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a non-superadmin user manager to delete superadmin accounts, causing loss of administrative access and accountability. Attackers could exploit this to remove critical administrative privileges, disrupt system management, and potentially gain unauthorized control over the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized privilege escalation and loss of administrative accountability. GDPR requires strict access controls and accountability, while HIPAA mandates role-based access and audit controls. Exploitation may result in unauthorized data access or system disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.1.9 or later to patch the vulnerability. Review user permissions and remove delete_user permission from non-superadmin accounts. Monitor admin API endpoints for suspicious DELETE requests targeting superadmin accounts.

Useful 0 Not Useful 0