CVE-2024-22208 (published 2024-02-05T21:15Z)

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-01-12 17:41:39+01:00
msg: fix: only allow 5 mails per user, don't allow the user to change the URL
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: api.service.php
change_type: ModificationType.MODIFY
diff: @@ -771,14 +771,30 @@ switch ($action) {
 
         $author = trim((string) Filter::filterVar($postData['name'], FILTER_SANITIZE_SPECIAL_CHARS));
         $email = Filter::filterVar($postData['email'], FILTER_VALIDATE_EMAIL);
-        $link = trim((string) Filter::filterVar($postData['link'], FILTER_VALIDATE_URL));
         $attached = trim((string) Filter::filterVar($postData['message'], FILTER_SANITIZE_SPECIAL_CHARS));
         $mailto = Filter::filterArray($postData['mailto[]']);
 
+        $faqLanguage = trim((string) Filter::filterVar($postData['lang'], FILTER_SANITIZE_SPECIAL_CHARS));
+        $faqId = trim((string) Filter::filterVar($postData['faqId'], FILTER_VALIDATE_INT));
+        $categoryId = trim((string) Filter::filterVar($postData['categoryId'], FILTER_VALIDATE_INT));
+
+        if (is_array($mailto) && count($mailto) > 5) {
+            $response->setStatusCode(Response::HTTP_BAD_REQUEST);
+            $response->setData(['error' => Translation::get('err_sendMail')]);
+            break;
+        }
+
         if (
             !is_null($author) && !is_null($email) && is_array($mailto) &&
             $stopWords->checkBannedWord(Strings::htmlspecialchars($attached))
         ) {
+            $send2friendLink = sprintf(
+                '%sindex.php?action=faq&amp;cat=%d&amp;id=%d&amp;artlang=%s',
+                $faqConfig->getDefaultUrl(),
+                $categoryId,
+                $faqId,
+                urlencode($faqLanguage)
+            );
 
             foreach ($mailto as $recipient) {
                 $recipient = trim(strip_tags((string) $recipient));
@@ -796,8 +812,8 @@ switch ($action) {
                         "%s\r\n\r\n%s\r\n%s\r\n\r\n%s",
                         $faqConfig->get('main.send2friendText'),
                         Translation::get('msgS2FText2'),
-                        $link,
-                        $attached
+                        $send2friendLink,
+                        strip_tags($attached)
                     );
 
                     // Send the email

programming_language: PHP
filename: send2friend.html
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,10 @@
   </div>
 
   <form id="formValues" action="#" method="post" accept-charset="utf-8" class="needs-validation" novalidate>
-    <input type="hidden" name="{{ msgS2FReferrer }}" value="{{ send2friendLink }}" />
-    <input type="hidden" name="lang" id="lang" value="{{ lang }}" />
+    <input type="hidden" name="{{ msgS2FReferrer }}" value="{{ send2friendLink }}">
+    <input type="hidden" name="lang" id="lang" value="{{ lang }}">
+    <input type="hidden" name="faqId" id="faqId" value="{{ faqId }}">
+    <input type="hidden" name="categoryId" id="categoryId" value="{{ categoryId }}">
 
     <div class="row mb-2">
       <label class="col-sm-3 form-control-label" for="name">{{ msgS2FName }}</label>

programming_language: HTML
filename: send2friend.php
change_type: ModificationType.MODIFY
diff: @@ -71,6 +71,8 @@ $template->parse(
     'mainPageContent',
     [
         'lang' => Strings::htmlentities($faqLanguage),
+        'faqId' => $faqId,
+        'categoryId' => $faqCategory,
         'msgSend2Friend' => Translation::get('msgSend2Friend'),
         'msgS2FReferrer' => 'link',
         'msgS2FName' => Translation::get('msgS2FName'),

programming_language: PHP