{"id":"GHSA-fxm2-cmwj-qvx4","summary":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","details":"### Summary\n\nAn authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration.\n\n### Details\n\nThe vulnerability exists in the `save` method within the `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` controller. This method handles the saving of application-wide configuration settings. It retrieves all submitted form data as an associative array via `$request-\u003eget('edit')`.\n\nThe core of the issue is that while the *values* of this array are processed, the *keys* are trusted implicitly and are not sanitized or validated.\n\n**File:** `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php`\n```php\n// ...\npublic function save(Request $request): JsonResponse\n{\n    $this-\u003euserHasPermission(PermissionType::CONFIGURATION_EDIT);\n\n    $configurationData = $request-\u003eget('edit');\n    // ...\n    \n    foreach ($configurationData as $key =\u003e $value) {\n        // The key from the user input is used to build the $newConfigValues array.\n        $newConfigValues[$key] = (string) $value;\n        // ...\n    }\n\n    // ...\n    // The array, containing user-controlled keys, is passed to the model.\n    $this-\u003econfiguration-\u003eupdate($newConfigValues);\n\n    return $this-\u003ejson(['success' =\u003e Translation::get('ad_config_saved')], Response::HTTP_OK);\n}\n```\n\nThe `$newConfigValues` array, which contains user-controlled keys, is then passed to the `update` method in the `src/phpMyFAQ/Configuration.php` model. Here, the key (`$name`) is directly concatenated into a raw SQL query string.\n\n**File:** `src/phpMyFAQ/Configuration.php`\n```php\npublic function update(array $newConfigs): bool\n{\n    // ...\n    foreach ($newConfigs as $name =\u003e $value) {\n        if ($name != 'main.phpMyFAQToken' && !in_array($name, $runtimeConfigs)) {\n            // VULNERABLE CODE: The array key '$name' is not escaped and is directly\n            // concatenated into the SQL query string. The value is escaped, but not the name.\n            $update = sprintf(\n                \"UPDATE %s%s SET config_value = '%s' WHERE config_name = '%s'\",\n                Database::getTablePrefix(),\n                $this-\u003etableName,\n                $this-\u003egetDb()-\u003eescape(trim($value)),\n                $name\n            );\n\n            $this-\u003egetDb()-\u003equery($update);\n            // ...\n        }\n    }\n\n    return true;\n}\n```\nAn attacker can craft a malicious form parameter name (which becomes the array key) to break out of the single quotes in the `WHERE` clause and inject arbitrary SQL commands.\n\n### PoC (Proof of Concept)\n\n**Prerequisites:**\n1.  A running instance of phpMyFAQ (v4.0.13 confirmed vulnerable).\n2.  An authenticated user session with permissions to edit the configuration.\n\n**Execution:**\nDue to the application's CSRF protection, the easiest way to reproduce this is by capturing a legitimate request to save the configuration and modifying it using a proxy tool like Burp Suite's Repeater.\n\n1.  Log in as an administrator and navigate to **Administration** -\u003e **Configuration**.\n2.  Make a trivial change (e.g., toggle a setting) and click \"Save configuration\". Capture this `POST` request to `/admin/api/configuration`.\n3.  Send the captured request to Repeater. The request will contain a valid `Cookie` header and a `pmf-csrf-token` parameter.\n4.  Modify the request body to inject a malicious key. Add a new `multipart/form-data` part with a crafted `name` attribute.\n\n**Example Malicious Request Body Part (Error-Based):**\n\n```\n------WebKitFormBoundaryRandomString\nContent-Disposition: form-data; name=\"edit[dummykey' and updatexml(1, concat(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT 0, 1), 0x7e), 1) and '1]\"\n\ntrue\n------WebKitFormBoundaryRandomString\n```\n*Note: You must also include the `pmf-csrf-token` part from the original request in the body.*\n\n**Result:**\nThe server will respond with a `500 Internal Server Error`, and the body of the response will contain a database error message, confirming the SQL injection. The leaked data will be present within the error string.\n\n```\nAn error occurred: XPATH syntax error: '~faq_faqadminlog~' at line 311 at /var/www/html/src/phpMyFAQ/Database/Mysqli.php\n```\n\nThis error confirms the successful execution of the injected `updatexml` payload, which has extracted and revealed the name of the first table in the database (`faq_faqadminlog`). Time-based blind techniques can also be used to extract data without relying on error messages.","aliases":["CVE-2025-62519"],"modified":"2025-11-17T19:37:58.076820Z","published":"2025-11-17T17:37:37Z","database_specific":{"nvd_published_at":"2025-11-17T17:15:50Z","cwe_ids":["CWE-89"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-11-17T17:37:37Z"},"references":[{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62519"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"},{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14"}],"affected":[{"package":{"name":"thorsten/phpmyfaq","ecosystem":"Packagist","purl":"pkg:composer/thorsten/phpmyfaq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14"}]}],"versions":["2.10.0-alpha","2.8.0","2.8.0-RC","2.8.0-RC2","2.8.0-RC3","2.8.0-RC4","2.8.0-alpha2","2.8.0-alpha3","2.8.0-beta","2.8.0-beta2","2.8.0-beta3","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.17","2.8.18","2.8.19","2.8.2","2.8.20","2.8.21","2.8.22","2.8.23","2.8.24","2.8.25","2.8.26","2.8.27","2.8.28","2.8.29","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-alpha","2.9.0-alpha2","2.9.0-alpha3","2.9.0-alpha4","2.9.0-beta","2.9.0-beta2","2.9.0-rc","2.9.0-rc2","2.9.0-rc3","2.9.0-rc4","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-RC","3.0.0-RC.2","3.0.0-alpha","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-beta","3.0.0-beta.2","3.0.0-beta.3","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC","3.1.0-alpha","3.1.0-alpha.2","3.1.0-alpha.3","3.1.0-beta","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-RC","3.2.0-RC.2","3.2.0-RC.4","3.2.0-alpha","3.2.0-beta","3.2.0-beta.2","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","4.0.0","4.0.0-RC","4.0.0-RC.2","4.0.0-RC.3","4.0.0-RC.4","4.0.0-RC.5","4.0.0-alpha","4.0.0-alpha.2","4.0.0-alpha.3","4.0.0-alpha.4","4.0.0-beta","4.0.0-beta.2","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.13","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-fxm2-cmwj-qvx4/GHSA-fxm2-cmwj-qvx4.json"}},{"package":{"name":"phpmyfaq/phpmyfaq","ecosystem":"Packagist","purl":"pkg:composer/phpmyfaq/phpmyfaq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14"}]}],"versions":["2.10.0-alpha","2.8.0","2.8.0-RC","2.8.0-RC2","2.8.0-RC3","2.8.0-RC4","2.8.0-alpha2","2.8.0-alpha3","2.8.0-beta","2.8.0-beta2","2.8.0-beta3","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.17","2.8.18","2.8.19","2.8.2","2.8.20","2.8.21","2.8.22","2.8.23","2.8.24","2.8.25","2.8.26","2.8.27","2.8.28","2.8.29","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-alpha","2.9.0-alpha2","2.9.0-alpha3","2.9.0-alpha4","2.9.0-beta","2.9.0-beta2","2.9.0-rc","2.9.0-rc2","2.9.0-rc3","2.9.0-rc4","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-RC","3.0.0-RC.2","3.0.0-alpha","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-beta","3.0.0-beta.2","3.0.0-beta.3","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC","3.1.0-alpha","3.1.0-alpha.2","3.1.0-alpha.3","3.1.0-beta","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-RC","3.2.0-RC.2","3.2.0-RC.4","3.2.0-alpha","3.2.0-beta","3.2.0-beta.2","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","4.0.0","4.0.0-RC","4.0.0-RC.2","4.0.0-RC.3","4.0.0-RC.4","4.0.0-RC.5","4.0.0-alpha","4.0.0-alpha.2","4.0.0-alpha.3","4.0.0-alpha.4","4.0.0-beta","4.0.0-beta.2","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.13","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-fxm2-cmwj-qvx4/GHSA-fxm2-cmwj-qvx4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}