Description

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T14:17:45.930Z",
  "pubdate": "2026-08-19T14:17:45.930Z",
  "executiveSummary": "phpMyFAQ versions before 4.1.7 contain an access control vulnerability within the PDF export endpoint that permits the retrieval of draft FAQ metadata. The vulnerability stems from a failure to properly validate the active status of FAQ records during export processing.\nUnauthenticated remote attackers can leverage this flaw by directly accessing the public PDF export route and iterating through sequential FAQ identifiers. Successful exploitation results in the unauthorized disclosure of sensitive information, including titles, solution IDs, author names, and last-update timestamps associated with inactive or unpublished FAQ entries.\nThe risk implication centers on information disclosure, potentially exposing internal development notes, proprietary drafts, or administrative structure to external parties without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of authorization and state validation checks within the PDF export component of phpMyFAQ prior to version 4.1.7. Specifically, the application processes requests to export FAQ content to PDF format without verifying whether the targeted record is marked as active, published, or publicly accessible.\nThe affected component is the public PDF export route and its underlying endpoint logic, which handles rendering and output generation for FAQ entries. Because the endpoint accepts sequential FAQ identifiers without validating the publication state against the database, it processes requests for drafts and unpublished records identically to published ones.\nThe exploitation method relies on Insecure Direct Object Reference (IDOR) combined with enumeration. An unauthenticated attacker sends HTTP requests to the public PDF export route using incrementing or sequential integer identifiers corresponding to FAQ records. Since network exposure is direct via the web interface, no special privileges, session tokens, or authentication mechanisms are required.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies the URL pattern for the PDF export endpoint. Second, the attacker formulates a script or automated tool to iterate through sequential FAQ IDs. Third, the application receives each request, queries the database for the corresponding record regardless of its active status, and generates the PDF output containing the metadata. Finally, the attacker parses the returned PDF documents to harvest titles, solution IDs, author names, and last-update timestamps of draft or unpublished FAQs.\nThe post-exploitation impact is strictly limited to unauthorized information disclosure, specifically metadata pertaining to inactive or unpublished content, which can aid attackers in mapping internal knowledge bases or identifying sensitive topics under development."
}