phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

Vulnerability

Description

phpMyFAQ versions 4.0.16 and below contain a broken access control vulnerability in the attachment download functionality. The root cause lies in attachment.php, where the permission check improperly validates authorization. The code uses isset($permission['dlattachment'])dlattachment']) to verify the right, but isset() returns true even when the permission value is false. This means the mere presence of the key in the permissions array is treated as proof of authorization, regardless of its actual boolean value is ignored [1][3].

Exploitation

An authenticated user without the dlattachment right can exploit this by sending a direct request to the attachment download endpoint. The flawed conditional expression ($groupPermission || ($groupPermission && $userPermission)) further simplifies to $groupPermission for some permission modes, bypassing user-level restrictions. The attack requires a non-admin user account and an FAQ record with an attachment, with guest downloads disabled [3].

Impact

Successful exploitation allows an attacker to download any FAQ attachment, leading to a confidentiality breach. Depending on the content of the attachments, this could expose sensitive documents or confidential information [1][3].\.

Mitigation

The issue has been fixed in phpMyFAQ version 4.0.17. Users are strongly advised to upgrade to this version or later. No workaround is mentioned in the advisory [1][3].