phpMyFAQ CVE-2025-69200

Requires that the phpMyFAQ instance be running a vulnerable version (< 4.0.16, or the 4.1.0-alpha-4.1.0-beta.2 pre-release branch) with the default .htaccess rewrite rules active, which expose /api/setup/(check|backup|update-database) to api/index.php. No authentication, API token, or user interaction is required; the attacker only needs to send a POST request with any non-empty body (interpreted as an 'installed version' string). The main limiting factors are reliance on the default rewrite configuration being present and the content/core/config/ directory being web-accessible - environments that have hardened or removed the setup rewrite rules, or restricted access to the config directory, would not be exploitable.

This is a genuine high-priority issue rather than an inflated high-CVSS score. All exploitability signals align toward easy abuse: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, and this is corroborated by the GHSA advisory, which confirms the /api/setup/backup endpoint is exposed via default .htaccess rewrite rules and performs no hasValidToken(), userIsAuthenticated(), or permission check. A working PoC is publicly available in the GitHub Security Advisory, lowering the barrier to mass exploitation. The impact profile is narrow but severe: C:H with I:N/A:N reflects pure confidentiality loss (disclosure of database.php credentials), not code execution - though the advisory correctly notes this enables follow-on compromise once DB credentials are obtained. Not in CISA KEV and no EPSS score was provided in the input, so widespread active exploitation is not confirmed; the combination of a public PoC, trivial exploitation, and default-configuration reachability nonetheless makes near-term opportunistic scanning likely. Verify EPSS independently, as it was absent from the provided data.

An attacker scanning the internet for phpMyFAQ instances sends an unauthenticated POST to /api/setup/backup with any non-empty body, causing the server to generate a configuration backup ZIP and return its direct URL. The attacker then downloads the ZIP from the web-accessible content/core/config/ path and extracts database.php to recover database host, username, and password. A public PoC (curl-based) exists in the GHSA advisory, making this trivially reproducible.