{"id":"CVE-2024-54141","aliases":["GHSA-vrjr-p3xp-xx2x"],"url":"https://o3.security/vulnerability/CVE-2024-54141","summary":"phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available","details":"### Summary\nExposure of database (ie postgreSQL) server's credential when connection to DB fails.\n\n### Details\nExposed database credentials upon misconfig/DoS @ permalink: https://github.com/thorsten/phpMyFAQ/blob/main/phpmyfaq/src/phpMyFAQ/Setup/Installer.php#L694\n\n### PoC\nWhen postgreSQL server is unreachable, an error would be thrown exposing the credentials of the database. For instance, when \"http://<phpmyfaq-instance>:8080/setup/index.php\" is hit when the database instance/server is down, then credentials are exposed, for instance:\n\n```\n( ! ) Warning: pg_connect(): Unable to connect to PostgreSQL server: connection to server at &quot;127.0.0.1&quot;, port 5432 failed: Connection refused Is the server running on that host and accepting TCP/IP connections? in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78\nCall Stack\n# Time Memory Function Location\n1 0.0404 453880 {main}( ) .../index.php:0\n2 1.1341 610016 phpMyFAQ\\Setup\\Installer->startInstall( $setup = ??? ) .../index.php:471\n3 1.2113 611544 phpMyFAQ\\Database\\Pgsql->connect( $host = '127.0.0.1', $user = 'cvecve', $password = '<redacted>', $database = 'cvecve', $port = 5432 ) .../Installer.php:694\n4 1.2113 611864 pg_connect( $connection_string = 'host=127.0.0.1 port=5432 dbname=cvecve user=cvecve password=<redacted>' ) .../Pgsql.php:78\n\n( ! ) Fatal error: Uncaught TypeError: Cannot assign false to property phpMyFAQ\\Database\\Pgsql::$conn of type ?PgSql\\Connection in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78\n( ! ) TypeError: Cannot assign false to property phpMyFAQ\\Database\\Pgsql::$conn of type ?PgSql\\Connection in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78\nCall Stack\n# Time Memory Function Location\n1 0.0404 453880 {main}( ) .../index.php:0\n2 1.1341 610016 phpMyFAQ\\Setup\\Installer->startInstall( $setup = ??? ) .../index.php:471\n3 1.2113 611544 phpMyFAQ\\Database\\Pgsql->connect( $host = '127.0.0.1', $user = 'cvecve', $password = '<redacted>', $database = 'cvecve', $port = 5432 ) .../Installer.php:694\n```\n![image](https://github.com/user-attachments/assets/feb9c0ba-0cf7-44d1-bd86-87cc36292b70)\n\nA way to force this would be to perform a denial of service on the database instance/server. When the db connection is refused, the credentials would show. The remote attacker can then use that to gain full control on the database.\n\n### Impact\nThis vulnerability exposes the credentials of the database and grants a remote attacker full control over the database.\n\nFirst notified Snyk on 16 Jan 2024.\n","published":"2024-12-06T15:00:16.407Z","modified":"2026-08-12T03:51:49.416310845Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"thorsten/phpmyfaq","fixedVersion":"4.0.0"}],"fix":{"url":"https://github.com/thorsten/phpMyFAQ/commit/b9289a0b2233df864361c131cd177b6715fbb0fe","label":"thorsten/phpMyFAQ@b9289a0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54141.json"},{"type":"ADVISORY","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-vrjr-p3xp-xx2x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54141"},{"type":"FIX","url":"https://github.com/thorsten/phpMyFAQ/commit/b9289a0b2233df864361c131cd177b6715fbb0fe"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.416310845Z"}}