phpMyFAQ SQL injections at insertentry & saveentry
Date: 2024-03
Affected: composer/phpmyfaq/phpmyfaq
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-28107
CWE: CWE-89
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Summary A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. ### PoC 1 - SQL Injection at insertentry: 1. Browse to “/admin/?action=editentry”, edit record and save. Intercept the POST request to "/admin/?action=insertentry" and modify the email and notes parameters in the body to the payloads below: a. `email=test'/*@email.com` b. `notes=*/,1,1,1,1,null,1);select+pg_sleep(5)--` 2. Send the request and notice the `pg_sleep(5)` command is executed with a time delay of 5 seconds in the response. This verifies that the SQL injection vulnerability exists. ![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/1000482f-3b00-462a-be8a-1eb21f720aca) ### PoC 2 - SQL Injection at saveentry 1. Browse to “/admin/?action=editentry”, edit record and save. Intercept the POST request to "/admin/?action=saveentry" and modify the email and notes parameters in the body to the payloads below: a. `email=test'/*@email.com` b. `*/,notes=(select+pg_sleep(5))--` 2. Send the request and notice the `pg_sleep(5)` command is executed with a time delay of 5 seconds in the response. This verifies that the SQL injection vulnerability exists. ![image](https://github.com/thorsten/phpMyFAQ/asse


Mitigations:

Architectural layers (MAESTRO):