CVE-2024-28105: Insufficient Information (NVD-CWE-noinfo)
value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/thorsten/phpMyFAQ
Language: PHP
Files changed: phpmyfaq/admin/api/attachment.php, phpmyfaq/src/phpMyFAQ/Attachment/File.php
Commit date: 2024-03-17 19:00:35 +0100
Commit message: fix: don't allow to upload arbitrary binary data

Diff: diff --git a/phpmyfaq/admin/api/attachment.php b/phpmyfaq/admin/api/attachment.php
index eb329b5588..31bc8e9851 100644
--- a/phpmyfaq/admin/api/attachment.php
+++ b/phpmyfaq/admin/api/attachment.php
@@ -79,11 +79,11 @@ switch ($ajaxAction) {
 
         foreach ($files as $file) {
             if (
                 is_uploaded_file($file['tmp_name']) &&
                 !($file['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
-                $file['type'] !== "text/html"
+                $file['type'] !== 'text/html' && $file['type'] !== 'application/octet-stream'
             ) {
                 $attachment = AttachmentFactory::create();
                 $attachment->setRecordId($recordId);
                 $attachment->setRecordLang($recordLang);
                 try {
@@ -99,11 +99,11 @@ switch ($ajaxAction) {
                     'faqId' => $recordId,
                     'faqLanguage' => $recordLang
                 ];
             } else {
                 $response->setStatusCode(Response::HTTP_BAD_REQUEST);
-                $response->setData('The image is too large.');
+                $response->setData('The file is too large or unsupported.');
                 $response->send();
                 return;
             }
         }
 
diff --git a/phpmyfaq/src/phpMyFAQ/Attachment/File.php b/phpmyfaq/src/phpMyFAQ/Attachment/File.php
index e2c6eb5596..cdb7e8af7e 100644
--- a/phpmyfaq/src/phpMyFAQ/Attachment/File.php
+++ b/phpmyfaq/src/phpMyFAQ/Attachment/File.php
@@ -101,11 +101,11 @@ class File extends AttachmentAbstract implements AttachmentInterface
             $this->saveMeta();
 
             $targetFile = $this->buildFilePath();
 
             if (null !== $this->id && $this->createSubDirs($targetFile)) {
-                // Doing this check we're sure not to unnecessary
+                // Doing this check, we're sure not to unnecessarily
                 // overwrite existing unencrypted file duplicates.
                 if (!$this->linkedRecords()) {
                     $source = new VanillaFile($filePath);
                     $target = $this->getFile(FilesystemFile::MODE_WRITE);
 

Vulnerable code:                 $file['type'] !== "text/html"
                $response->setData('The image is too large.');
                // Doing this check we're sure not to unnecessary
Fixed code:                 $file['type'] !== 'text/html' && $file['type'] !== 'application/octet-stream'
                $response->setData('The file is too large or unsupported.');
                // Doing this check, we're sure not to unnecessarily