CVE-2025-62519: Thorsten/phpmyfaq SQL Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fxm2-cmwj-qvx4",
  "modified" : "2025-11-17T18:57:46Z",
  "published" : "2025-11-17T17:37:37Z",
  "aliases" : [ "CVE-2025-62519" ],
  "summary" : "phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality",
  "details" : "### Summary\n\nAn authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration.\n\n### Details\n\nThe vulnerability exists in the `save` method within the `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` controller. This method handles the saving of application-wide configuration settings. It retrieves all submitted form data as an associative array via `$request->get('edit')`.\n\nThe core of the issue is that while the *values* of this array are processed, the *keys* are trusted implicitly and are not sanitized or validated.\n\n**File:** `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php`\n```php\n// ...\npublic function save(Request $request): JsonResponse\n{\n    $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);\n\n    $configurationData = $request->get('edit');\n    // ...\n    \n    foreach ($configurationData as $key => $value) {\n        // The key from the user input is used to build the $newConfigValues array.\n        $newConfigValues[$key] = (string) $value;\n        // ...\n    }\n\n    // ...\n    // The array, containing user-controlled keys, is passed to the model.\n    $this->configuration->update($newConfigValues);\n\n    return $this->json(['success' => Translation::get('ad_config_saved')], Response::HTTP_OK);\n}\n```\n\nThe `$newConfigValues` array, which contains user-controlled keys, is then passed to the `update` method in the `src/phpMyFAQ/Configuration.php` model. Here, the key (`$name`) is directly concatenated into a raw SQL query string.\n\n**File:** `src/phpMyFAQ/Configuration.php`\n```php\npublic function update(array $newConfigs): bool\n{\n    // ...\n    foreach ($newConfigs as $name => $value) {\n        if ($name != 'main.phpMyFAQToken' && !in_array($name, $runtimeConfigs)) {\n            // VULNERABLE CODE: The array key '$name' is not escaped and is directly\n            // concatenated into the SQL query string. The value is escaped, but not the name.\n            $update = sprintf(\n                \"UPDATE %s%s SET config_value = '%s' WHERE config_name = '%s'\",\n                Database::getTablePrefix(),\n                $this->tableName,\n                $this->getDb()->escape(trim($value)),\n                $name\n            );\n\n            $this->getDb()->query($update);\n            // ...\n        }\n    }\n\n    return true;\n}\n```\nAn attacker can craft a malicious form parameter name (which becomes the array key) to break out of the single quotes in the `WHERE` clause and inject arbitrary SQL commands.\n\n### PoC (Proof of Concept)\n\n**Prerequisites:**\n1.  A running instance of phpMyFAQ (v4.0.13 confirmed vulnerable).\n2.  An authenticated user session with permissions to edit the configuration.\n\n**Execution:**\nDue to the application's CSRF protection, the easiest way to reproduce this is by capturing a legitimate request to save the configuration and modifying it using a proxy tool like Burp Suite's Repeater.\n\n1.  Log in as an administrator and navigate to **Administration** -> **Configuration**.\n2.  Make a trivial change (e.g., toggle a setting) and click \"Save configuration\". Capture this `POST` request to `/admin/api/configuration`.\n3.  Send the captured request to Repeater. The request will contain a valid `Cookie` header and a `pmf-csrf-token` parameter.\n4.  Modify the request body to inject a malicious key. Add a new `multipart/form-data` part with a crafted `name` attribute.\n\n**Example Malicious Request Body Part (Error-Based):**\n\n```\n------WebKitFormBoundaryRandomString\nContent-Disposition: form-data; name=\"edit[dummykey' and updatexml(1, concat(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT 0, 1), 0x7e), 1) and '1]\"\n\ntrue\n------WebKitFormBoundaryRandomString\n```\n*Note: You must also include the `pmf-csrf-token` part from the original request in the body.*\n\n**Result:**\nThe server will respond with a `500 Internal Server Error`, and the body of the response will contain a database error message, confirming the SQL injection. The leaked data will be present within the error string.\n\n```\nAn error occurred: XPATH syntax error: '~faq_faqadminlog~' at line 311 at /var/www/html/src/phpMyFAQ/Database/Mysqli.php\n```\n\nThis error confirms the successful execution of the injected `updatexml` payload, which has extracted and revealed the name of the first table in the database (`faq_faqadminlog`). Time-based blind techniques can also be used to extract data without relying on error messages.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "thorsten/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.14"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.0.13"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmyfaq/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.14"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.0.13"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-62519"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thorsten/phpMyFAQ"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-11-17T17:37:37Z",
    "nvd_published_at" : "2025-11-17T17:15:50Z"
  }
}