{"id":"CVE-2025-62519","aliases":["GHSA-fxm2-cmwj-qvx4"],"url":"https://o3.security/vulnerability/CVE-2025-62519","summary":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","details":"### Summary\n\nAn authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration.\n\n### Details\n\nThe vulnerability exists in the `save` method within the `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` controller. This method handles the saving of application-wide configuration settings. It retrieves all submitted form data as an associative array via `$request->get('edit')`.\n\nThe core of the issue is that while the *values* of this array are processed, the *keys* are trusted implicitly and are not sanitized or validated.\n\n**File:** `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php`\n```php\n// ...\npublic function save(Request $request): JsonResponse\n{\n    $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);\n\n    $configurationData = $request->get('edit');\n    // ...\n    \n    foreach ($configurationData as $key => $value) {\n        // The key from the user input is used to build the $newConfigValues array.\n        $newConfigValues[$key] = (string) $value;\n        // ...\n    }\n\n    // ...\n    // The array, containing user-controlled keys, is passed to the model.\n    $this->configuration->update($newConfigValues);\n\n    return $this->json(['success' => Translation::get('ad_config_saved')], Response::HTTP_OK);\n}\n```\n\nThe `$newConfigValues` array, which contains user-controlled keys, is then passed to the `update` method in the `src/phpMyFAQ/Configuration.php` model. Here, the key (`$name`) is directly concatenated into a raw SQL query string.\n\n**File:** `src/phpMyFAQ/Configuration.php`\n```php\npublic function update(array $newConfigs): bool\n{\n    // ...\n    foreach ($newConfigs as $name => $value) {\n        if ($name != 'main.phpMyFAQToken' && !in_array($name, $runtimeConfigs)) {\n            // VULNERABLE CODE: The array key '$name' is not escaped and is directly\n            // concatenated into the SQL query string. The value is escaped, but not the name.\n            $update = sprintf(\n                \"UPDATE %s%s SET config_value = '%s' WHERE config_name = '%s'\",\n                Database::getTablePrefix(),\n                $this->tableName,\n                $this->getDb()->escape(trim($value)),\n                $name\n            );\n\n            $this->getDb()->query($update);\n            // ...\n        }\n    }\n\n    return true;\n}\n```\nAn attacker can craft a malicious form parameter name (which becomes the array key) to break out of the single quotes in the `WHERE` clause and inject arbitrary SQL commands.\n\n### PoC (Proof of Concept)\n\n**Prerequisites:**\n1.  A running instance of phpMyFAQ (v4.0.13 confirmed vulnerable).\n2.  An authenticated user session with permissions to edit the configuration.\n\n**Execution:**\nDue to the application's CSRF protection, the easiest way to reproduce this is by capturing a legitimate request to save the configuration and modifying it using a proxy tool like Burp Suite's Repeater.\n\n1.  Log in as an administrator and navigate to **Administration** -> **Configuration**.\n2.  Make a trivial change (e.g., toggle a setting) and click \"Save configuration\". Capture this `POST` request to `/admin/api/configuration`.\n3.  Send the captured request to Repeater. The request will contain a valid `Cookie` header and a `pmf-csrf-token` parameter.\n4.  Modify the request body to inject a malicious key. Add a new `multipart/form-data` part with a crafted `name` attribute.\n\n**Example Malicious Request Body Part (Error-Based):**\n\n```\n------WebKitFormBoundaryRandomString\nContent-Disposition: form-data; name=\"edit[dummykey' and updatexml(1, concat(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT 0, 1), 0x7e), 1) and '1]\"\n\ntrue\n------WebKitFormBoundaryRandomString\n```\n*Note: You must also include the `pmf-csrf-token` part from the original request in the body.*\n\n**Result:**\nThe server will respond with a `500 Internal Server Error`, and the body of the response will contain a database error message, confirming the SQL injection. The leaked data will be present within the error string.\n\n```\nAn error occurred: XPATH syntax error: '~faq_faqadminlog~' at line 311 at /var/www/html/src/phpMyFAQ/Database/Mysqli.php\n```\n\nThis error confirms the successful execution of the injected `updatexml` payload, which has extracted and revealed the name of the first table in the database (`faq_faqadminlog`). Time-based blind techniques can also be used to extract data without relying on error messages.","published":"2025-11-17T16:48:49.678Z","modified":"2026-08-12T03:51:29.911649974Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"thorsten/phpmyfaq","fixedVersion":"4.0.14"},{"ecosystem":"Packagist","name":"phpmyfaq/phpmyfaq","fixedVersion":"4.0.14"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62519.json"},{"type":"ADVISORY","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62519"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.911649974Z"}}