High severityNVD Advisory· Published Mar 25, 2024· Updated Apr 10, 2025
phpMyFAQ SQL injections at insertentry & saveentry
CVE-2024-28107
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the insertentry & saveentry when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
phpmyfaq/phpmyfaqPackagist | >= 3.2.5, < 3.2.6 | 3.2.6 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-2grw-mc9r-822rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-28107ghsaADVISORY
- github.com/thorsten/phpMyFAQ/commit/d0fae62a72615d809e6710861c1a7f67ac893007ghsax_refsource_MISCWEB
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2grw-mc9r-822rghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.