phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Date: 2025-11
Affected: composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-62519
CWE: CWE-89
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

### Summary An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. ### Details The vulnerability exists in the `save` method within the `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` controller. This method handles the saving of application-wide configuration settings. It retrieves all submitted form data as an associative array via `$request->get('edit')`. The core of the issue is that while the *values* of this array are processed, the *keys* are trusted implicitly and are not sanitized or validated. **File:** `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` ```php // ... public function save(Request $request): JsonResponse { $this->userHasPermission(PermissionType::CONFIGURATION_EDIT); $configurationData = $request->get('edit'); // ... foreach ($configurationData as $key => $value) { // The key from the user input is used to build the $newConfigValues array. $newConfigValues[$key] = (string) $value; // ... } // ... // The array, containing user-controlled keys, is passed to the model. $this->


Mitigations:

Architectural layers (MAESTRO):