phpMyFAQ 4.0.16 - Improper Authorization

ExploitDBExploitDB exploitScannerEDB-52523

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides curl commands that demonstrate how an authenticated non-admin user can trigger a configuration backup via the /api/setup/backup endpoint and observe the response containing a link to the generated ZIP. It does not include code to extract, download, or otherwise exploit the backup; it only validates the missing authorization by showing the endpoint returns a successful response with a backup path.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a plaintext description of an improper authorization vulnerability (CVE-2026-24421) in phpMyFAQ. It contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform any action beyond reading. The curl commands are standard HTTP requests that demonstrate the vulnerability against a target server, not against the reviewer's machine. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagesshell
Target softwarephpMyFAQ
Attack typesmissing authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact only demonstrates triggering the backup endpoint and observing the response containing a backup path. It does not include any code to download, extract, or otherwise exploit the backup file. The description explicitly states the endpoint 'returns a link/path to the generated ZIP' and the impact notes that exposure requires a separate server misconfiguration. The provided curl commands serve to validate the missing authorization, which is characteristic of a scanner.

exploits/php/webapps/52523.txt:12exploits/php/webapps/52523.txt:32exploits/php/webapps/52523.txt:35

Requirements

  • API must be enabled on the target phpMyFAQ instanceexploits/php/webapps/52523.txt:18
  • Attacker must have valid credentials for a non-admin userexploits/php/webapps/52523.txt:18

Observed behavior

  • Logs in as a non-admin user via the API login endpointexploits/php/webapps/52523.txt:21-24
  • Sends a POST request to /api/setup/backup to trigger backup generationexploits/php/webapps/52523.txt:27-29
  • Observes the API response which includes a link/path to the generated ZIP backupexploits/php/webapps/52523.txt:32
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Curl Command
curl -c /tmp/pmf_api_cookies.txt -H 'Content-Type: application/json' -d '{"username":"tester","password":"Test1234!"}' http://192.168.40.16/phpmyfaq/api/v3.0/loginDemonstrates authentication step for the PoC; targets a remote server, not the reviewer's machine.exploits/php/webapps/52523.txt:21-24
Curl Command
curl -i -b /tmp/pmf_api_cookies.txt -X POST --data '4.0.16' http://192.168.40.16/phpmyfaq/api/setup/backupDemonstrates the exploit step; triggers backup generation on a remote server, not on the reviewer's machine.exploits/php/webapps/52523.txt:27-29
Vulnerability Description
phpMyFAQ <= 4.0.16 Improper Authorization (CVE-2026-24421)The PoC describes a legitimate vulnerability in a third-party application; no backdoor or deceptive payload is embedded in the PoC itself.exploits/php/webapps/52523.txt:1-38
Review boundaries

What the analysis did not establish

  • Only the single text file from ExploitDB was analyzed; no external resources or referenced tools were inspected.
  • The artifact does not include code to download or extract the backup, so exploitation impact is not demonstrated.
  • Only the supplied text file was reviewed; no external resources, tools, or libraries referenced in the PoC were fetched or analyzed.
  • Binary content is flagged as not analyzed, but no binary files are present in this evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1