Description

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T14:17:42.053Z",
  "pubdate": "2026-08-19T14:17:42.053Z",
  "executiveSummary": "phpMyFAQ before version 4.1.7 contains an insecure token storage vulnerability that allows unauthenticated remote attackers to compromise user accounts.\nThe vulnerability arises when user tracking is enabled, causing the application to write sensitive password reset tokens into a publicly accessible tracking file located at content/core/data/trackingDDMMYYYY.\nAn unauthenticated attacker can directly access and read this tracking file via HTTP requests, harvest valid password reset tokens, and subsequently replay them against the application's password reset API.\nSuccessful exploitation results in complete account takeover for arbitrary users whose password reset requests are tracked, bypassing standard authentication controls entirely.\nThe risk is critical due to the lack of authentication required to access the tracking data and the high-impact outcome of unauthorized account access across affected phpMyFAQ installations.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of sensitive cryptographic data in phpMyFAQ prior to version 4.1.7.\nWhen the user tracking functionality is enabled within the application, generated password reset tokens are inadvertently logged or stored within daily tracking files.\nThese tracking files are written to a predictable and publicly accessible directory path, specifically content/core/data/trackingDDMMYYYY, where DDMMYYYY represents the date format of the tracking log.\nBecause the storage location lacks proper access controls or authentication mechanisms, remote unauthenticated attackers can issue standard HTTP GET requests to retrieve the contents of the tracking files.\nThe attack flow proceeds as follows: First, the attacker identifies or triggers a password reset action for a targeted user account. Second, the application generates a reset token and writes it to the daily tracking file. Third, the attacker accesses the publicly exposed content/core/data/trackingDDMMYYYY file to extract the newly generated token. Fourth, the attacker submits the harvested token to the password reset API endpoint to complete the reset process and establish unauthorized control over the targeted account.\nThe vulnerable component is the user tracking and logging subsystem of phpMyFAQ.\nAffected systems include all phpMyFAQ installations prior to version 4.1.7 where user tracking features are active.\nNo authentication or special privileges are required to exploit this flaw, and the attack can be executed over the network by accessing the publicly exposed file paths."
}