Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows unauthenticated attackers to inject malicious SQL commands into phpMyFAQ through its API. This can lead to the extraction of sensitive information like user credentials and administrative tokens.
- Sensitive data can be stolen.
- Affects systems reachable from the internet.
- Exploitable without a login.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this SQL injection flaw by sending specially crafted requests to the `/api/captcha` endpoint. The vulnerability lies in how the application processes the User-Agent header, interpolating it directly into database queries without proper sanitization. This allows attackers to manipulate the queries to extract sensitive information from the database.
- No authentication required.
- Targets the `/api/captcha` endpoint.
- Exploits unsanitized User-Agent header.
Live Threat
Current exploitation, exposure, and threat context
Attackers are likely to weaponize this vulnerability due to its unauthenticated nature and the direct access to sensitive data. The SQL injection flaw allows for immediate data exfiltration without any prior compromise. The public API endpoint makes exploitation straightforward for motivated actors.
- Publicly accessible API endpoint.
- Direct access to sensitive data.
- Unauthenticated exploitation.
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking traffic to the `/api/captcha` endpoint and reviewing logs for anomalous User-Agent strings, as exploitation is highly likely. Teams should focus on identifying all instances of phpMyFAQ and assessing their exposure to external requests. If the application is publicly accessible, consider taking it offline until a patch can be applied.
- Block public access to the captcha endpoint.
- Upgrade phpMyFAQ to 4.1.2 or later.
- Monitor for SQL injection patterns in logs.
