CyberRota Analysis
AI-GeneratedVersions of phpMyFAQ prior to 4.1.6 are vulnerable due to inadequate validation of the security.enableRegistration setting in API endpoints, enabling attackers to create user accounts even when registration is disabled. This flaw allows unauthorized access to the system, potentially leading to further exploitation. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized account creation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.
Related CVEs
Other vulnerabilities affecting the same vendor(s)