CVE-2014-6046

Vulnerability

phpMyFAQ versions up to 2.8.12 contain multiple cross-site request forgery (CSRF) vulnerabilities. The 'delete user' functionality improperly validates CSRF tokens, and other operations (deleting open questions, activating users, publishing FAQs, adding/deleting Glossary, adding/deleting FAQ news, adding/deleting comments, or adding votes) lack a CSRF token entirely. These issues are documented in advisory [1] and tracked as CVE-2014-6046.

Exploitation

An attacker can craft a malicious request that, when sent to an authenticated admin or user, executes unauthorized actions. The attacker must trick the victim into visiting a crafted page or clicking a link while they are authenticated. For the 'delete user' operation, improper CSRF token validation allows the exploit; for other operations, the complete absence of CSRF tokens facilitates the attack. No special network position is required beyond the ability to deliver the crafted request.

Impact

Successful exploitation allows an attacker to perform administrative actions on behalf of the victim, such as deleting active users, deleting open questions, activating users, publishing FAQs, modifying Glossary entries, altering FAQ news, changing comments, or casting votes. This leads to unauthorized modification of FAQ data and potential privilege escalation, compromising the integrity and availability of the application.

Mitigation

The phpMyFAQ team released version 2.8.13 to fix these CSRF vulnerabilities [1]. All users should upgrade immediately. No workaround exists except installing the patched version.