Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | <= 4.1.3 | 4.1.4 |
| phpmyfaq/phpmyfaq | composer | <= 4.1.3 | 4.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php file, where attachment passwords were being hashed using the cryptographically weak SHA-1 algorithm. The analysis of the patch commit 1aa9be6f8a2fa5c527c983826205229fc3129718 reveals that the setKey function was responsible for this insecure operation. Specifically, the line $this->passwordHash = sha1((string) $key); was removed from this function. This line took the provided key (password), hashed it with SHA-1, and stored it in the $passwordHash property. The commit message confirms that this hashed password was never actually used for verification, making it dead code that nonetheless created a security risk (CWE-328: Use of Weak Hash). Therefore, any runtime profile during the process of setting a password for an attachment would show the phpMyFAQ\Attachment\AbstractAttachment::setKey function in the stack trace, which was the function containing the vulnerable code.
phpMyFAQ\Attachment\AbstractAttachment::setKeyphpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php