CVE-2024-28105: phpMyFAQ's File Upload Bypass at Category Image Leads to RCE

March 25, 2024

The category image upload function in phpmyfaq is vulnerable to manipulation of the Content-type and lang parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system.

References

github.com/advisories/GHSA-pwh2-fpfr-x5gf
github.com/thorsten/phpMyFAQ
github.com/thorsten/phpMyFAQ/commit/9136883776af67dfdb0e8cf14f5e0ca22bf4f2e7
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pwh2-fpfr-x5gf
nvd.nist.gov/vuln/detail/CVE-2024-28105

Code Behaviors & Features

Detect and mitigate CVE-2024-28105 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →