CVE-2024-22208 (PHP, published 2024-02-05T21:15Z)
Description: value: phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/api.service.php
phpmyfaq/assets/themes/default/templates/send2friend.html
phpmyfaq/send2friend.php
Commit message: fix: only allow 5 mails per user, don't allow the user to change the URL


Vulnerable code:
        $link = trim((string) Filter::filterVar($postData['link'], FILTER_VALIDATE_URL));
                        $link,
                        $attached
    <input type="hidden" name="{{ msgS2FReferrer }}" value="{{ send2friendLink }}" />
    <input type="hidden" name="lang" id="lang" value="{{ lang }}" />

Fixed code:
        $faqLanguage = trim((string) Filter::filterVar($postData['lang'], FILTER_SANITIZE_SPECIAL_CHARS));
        $faqId = trim((string) Filter::filterVar($postData['faqId'], FILTER_VALIDATE_INT));
        $categoryId = trim((string) Filter::filterVar($postData['categoryId'], FILTER_VALIDATE_INT));

        if (is_array($mailto) && count($mailto) > 5) {
            $response->setStatusCode(Response::HTTP_BAD_REQUEST);
            $response->setData(['error' => Translation::get('err_sendMail')]);
            break;
        }

            $send2friendLink = sprintf(
                '%sindex.php?action=faq&amp;cat=%d&amp;id=%d&amp;artlang=%s',
                $faqConfig->getDefaultUrl(),
                $categoryId,
                $faqId,
                urlencode($faqLanguage)
            );
                        $send2friendLink,
                        strip_tags($attached)
    <input type="hidden" name="{{ msgS2FReferrer }}" value="{{ send2friendLink }}">
    <input type="hidden" name="lang" id="lang" value="{{ lang }}">
    <input type="hidden" name="faqId" id="faqId" value="{{ faqId }}">
    <input type="hidden" name="categoryId" id="categoryId" value="{{ categoryId }}">
        'faqId' => $faqId,
        'categoryId' => $faqCategory,