Description (CNA)
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| thorsten / phpMyFAQ | affected 4.0.0 before 4.1.9; unaffected 4.1.9 |
CWE
CWE-863
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api
ADP enrichment
No English description supplied.