CVE-2024-27299

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the `authorEmail` field which uses PHP's `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6.

• CWE-89
• CWE-89

• https://drive.google.com/drive/folders/1BFL8GHIBxSUxu0TneYf66KjFA0A4RZga?usp=sharingExploit
• https://github.com/thorsten/phpMyFAQ/commit/1b68a5f89fb65996c56285fa636b818de8608011Patch
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcwExploit, Vendor Advisory
• https://drive.google.com/drive/folders/1BFL8GHIBxSUxu0TneYf66KjFA0A4RZga?usp=sharingExploit
• https://github.com/thorsten/phpMyFAQ/commit/1b68a5f89fb65996c56285fa636b818de8608011Patch
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcwExploit, Vendor Advisory

Published

Mar 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27292Docassemble is an expert system for guided interviews and do…7.5
• CVE-2024-27294dp-golang is a Puppet module for Go installations. Prior to…7.8
• CVE-2024-27295Directus is a real-time API and App dashboard for managing S…8.2
• CVE-2024-27296Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2024-27297Nix is a package manager for Linux and other Unix systems. A…5.9
• CVE-2024-27298parse-server is a Parse Server for Node.js / Express. This v…10
• CVE-2024-2730Mautic uses predictable page indices for unpublished landing…5.3
• CVE-2024-27300phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-27301Support App is an opensource application specialized in mana…7.3
• CVE-2024-27302go-zero is a web and rpc framework. Go-zero allows user to s…9.1
• CVE-2024-27303electron-builder is a solution to package and build a ready …7.3
• CVE-2024-27304pgx is a PostgreSQL driver and toolkit for Go. SQL injection…9.8