CVE-2024-28107

Name: CVE-2024-28107
Creator: NVD / NIST
Published: 2024-03-25T19:15:58.477+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.97%

Last modified Jun 17, 2026

CVE-2024-28107 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. EPSS estimates a 0.97% chance of exploitation in the next 30 days.

Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.97%

57.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Phpmyfaq	Phpmyfaq	3.2.5

References

https://github.com/thorsten/phpMyFAQ/commit/d0fae62a72615d809e6710861c1a7f67ac893007Patch
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2grw-mc9r-822rExploit, Vendor Advisory
https://github.com/thorsten/phpMyFAQ/commit/d0fae62a72615d809e6710861c1a7f67ac893007Patch
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2grw-mc9r-822rExploit, Vendor Advisory

Timeline

Published: Mar 25, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-28107?

How severe is CVE-2024-28107?

CVE-2024-28107 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.97% probability of exploitation in the next 30 days.

How do I fix CVE-2024-28107?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-28107?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST