CVE-2024-28107
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 25, 2024
Updated: Jan 9, 2025
CWE ID 89
Summary
CVE-2024-28107 is a SQL injection vulnerability affecting phpMyFAQ, an open-source FAQ web application for PHP 8.1 and above, and various databases. The vulnerability is found in the `insertentry` and `saveentry` functions when modifying records. It stems from inadequate email address escaping, enabling any authorized user with the right to modify FAQ news to exfiltrate data, hijack accounts, and in certain cases, execute remote code. This vulnerability has been addressed in version 3.2.6.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.