CVE-2023-1887: 
PHP vulnerability analysis and mitigation

A business logic error vulnerability was identified in GitHub repository thorsten/phpmyfaq prior to version 3.1.12, tracked as CVE-2023-1887. The vulnerability was discovered and disclosed on April 5, 2023, affecting the permission checking functionality in the phpMyFAQ application (CVE Mitre).

The vulnerability stems from an incorrect permission check implementation in the admin/record.add.php file. The original code incorrectly checked for both 'edit_faq' and 'add_faq' permissions when only 'add_faq' permission should have been required (GitHub Commit).

The vulnerability could allow users with only 'edit_faq' permission to add new FAQ entries, potentially bypassing intended access controls and leading to unauthorized content creation in the phpMyFAQ system (Huntr Report).

The vulnerability requires an authenticated user with 'edit_faq' permission to exploit the issue. The attack vector involves accessing the FAQ addition functionality, which should normally be restricted to users with 'add_faq' permission (GitHub Commit).

The vulnerability was fixed in phpMyFAQ version 3.1.12 by correcting the permission check logic to only verify the 'add_faq' permission. Users should upgrade to this version or later to address the issue (GitHub Commit).