phpMyFAQ: Public API endpoints expose emails and invisible questions

Vulnerability

Description

The phpMyFAQ application (versions 4.0.16 and earlier) contains an information disclosure vulnerability in its public API endpoints. Specifically, the OpenQuestionController::list() endpoint invokes Question::getAll() with the default parameter showAll=true, causing it to return questions that are marked as non-public (isVisible=false) along with the email addresses of the users who submitted them [1][3]. Similar issues exist in comment, news, and FAQ APIs, where sensitive data such as email addresses and private records are exposed without proper authentication checks [1].

Exploitation

The vulnerable endpoints are publicly accessible and require no authentication. An attacker can simply make a GET request to /api/v3.0/open-questions (or similar paths) to retrieve the exposed data [3]. The official proof-of-concept demonstrates that a simple curl command suffices to extract email addresses and hidden content [3]. No special privileges or network position are needed; the attack can be carried out remotely over the internet.

Impact

This vulnerability enables attackers to harvest email addresses for phishing campaigns or to scrape content that administrators intended to be private. The exposure of internal or unanswered questions could also reveal sensitive business information. The overall impact is a breach of user privacy and potential facilitation of social engineering attacks [1][3].

Mitigation

The issue has been addressed in phpMyFAQ version 4.0.17 [1]. Users are strongly advised to upgrade to this latest version to prevent unauthorized access to sensitive API data.