CVE-2024-28105
CVE-2024-28105 · phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
This page contains facts from public vulnerability sources. Check the original advisory before updating.
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.
CVSS 7.2 · High · EPSS 1.5% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
phpmyfaq
- Versions
- 3.2.5: Affected
No fix published
phpmyfaq/phpmyfaq Packagist
- Versions
- 3.2.5
- Affected ranges
- ECOSYSTEM: ≥ 3.2.5, < 3.2.6
Update to 3.2.6