Description

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T14:17:42.260Z",
  "pubdate": "2026-08-19T14:17:42.260Z",
  "executiveSummary": "An authentication bypass vulnerability exists within phpMyFAQ prior to version 4.1.7, specifically residing in the SetupController component. This security flaw enables unauthenticated remote attackers to execute sensitive administrative actions under specific operational conditions, namely when maintenance mode is enabled on the target instance.\nThe primary impact of this vulnerability includes the unauthorized execution of database migrations, the generation of configuration backups, the disabling of maintenance mode, and the extraction of sensitive database credentials from generated ZIP archives. The risk implications are severe, as unauthorized actors can manipulate core application states and harvest critical database connection secrets.\nExploitation requires the target system to have maintenance mode enabled and involves interacting directly with specific API endpoints. No prior authentication or privileged access is required by the attacker to initiate the request chain against the exposed endpoints.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the SetupController of phpMyFAQ prior to version 4.1.7. Specifically, the application fails to adequately validate authentication and authorization states for setup-related administrative routines when maintenance mode is active.\nThe vulnerable components comprise the API endpoints POST /api/setup/update-database and POST /api/setup/backup, which are exposed over HTTP/HTTPS protocols and accessible to unauthenticated network traffic.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies that the target phpMyFAQ instance has maintenance mode enabled. Second, the attacker sends a malicious HTTP POST request to the POST /api/setup/update-database endpoint. This action forces the application to execute unauthorized database updates and alters the application state by disabling maintenance mode. Third, the attacker issues an HTTP POST request to the POST /api/setup/backup endpoint, triggering the generation of a configuration backup. Finally, the attacker downloads and inspects the resulting ZIP archive, extracting sensitive database credentials contained within.\nThe post-exploitation impact allows the adversary to bypass access restrictions, gain unauthorized administrative control over database schemas, alter application availability states, and exfiltrate credentials that may facilitate further network compromise or unauthorized database access."
}