Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lack of proper permission checks when fetching FAQ entries by their solution ID. The advisory GHSA-99qv-g4x9-mgc3 clearly outlines the vulnerable functions and the exploitation path. The getIdFromSolutionId function in phpMyFAQ\Faq directly queries the database for a FAQ entry by its solution_id without considering any user permissions. This function is called by the solution function in the FaqController, which is exposed via the /solution_id_{id}.html URL. An unauthenticated attacker can iterate through solution IDs to trigger this vulnerability. When a valid solution_id for a restricted FAQ is provided, the getIdFromSolutionId function returns its data, including the title. The solution controller then uses this title to generate a slug and redirects the user to a URL containing this slug. This leaks the title of the restricted FAQ. A second function, getFaqBySolutionId, also in phpMyFAQ\Faq, has a fallback mechanism that queries the database without permission checks if the initial, permission-aware query fails. This further widens the potential for information disclosure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 4.1.2 | 4.1.2 |
| phpmyfaq/phpmyfaq | composer | < 4.1.2 | 4.1.2 |
