CyberRota Analysis
AI-GeneratedphpMyFAQ versions prior to 4.1.7 are vulnerable to improper HTML sanitization in FAQ answers, allowing authenticated users to embed malicious <img> tags that reference local files. When generating PDFs, this can lead to the disclosure of sensitive file contents, including database credentials, through uncaught exceptions. Organizations using phpMyFAQ should prioritize patching to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials.
Related CVEs
Other vulnerabilities affecting the same vendor(s)