CVE-2024-22208 phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
Attackers can bypass email limits to send mass phishing emails via the FAQ sharing feature, damaging server reputation and enabling spam campaigns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22208?
CVE-2024-22208 is a medium-severity vulnerability in Phpmyfaq Phpmyfaq, published on 5 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.
Weakness: CWE-863
Which versions are affected by CVE-2024-22208?
2 open source packages ship an affected version, including phpmyfaq/phpmyfaq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmyfaq/phpmyfaq Packagist | All versions | 3.2.5 |
phpmyfaq/phpmyfaq Packagist | All versions | 3.2.5 |
Products include Phpmyfaq Phpmyfaq.
How do I fix CVE-2024-22208?
Upgrade phpmyfaq/phpmyfaq to 3.2.5 or later.
Is CVE-2024-22208 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22208 exists.
Other vulnerabilities in Phpmyfaq Phpmyfaq
- CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
- CVE-2017-11187 Security feature bypass in n/a
- CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
- CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
Sources
Also known as GHSA-9hhf-xmcw-r3xg.