CVE-2024-28107: 
PHP vulnerability analysis and mitigation

phpMyFAQ, an open source FAQ web application for PHP 8.1+ and MySQL/PostgreSQL, was found to contain a SQL injection vulnerability (CVE-2024-28107) in version 3.2.5. The vulnerability was discovered in the insertentry & saveentry functions when modifying records, specifically due to improper escaping of email addresses. The issue was fixed in version 3.2.6 (GitHub Advisory).

The vulnerability is classified as CWE-89 (SQL Injection) with a CVSS v3.1 base score of 8.8 (HIGH), having a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from insufficient escaping of email address values in the insertentry and saveentry functions, allowing for SQL injection attacks through manipulated email parameters (GitHub Advisory).

The vulnerability allows authenticated users with FAQ editing rights to execute malicious SQL queries, potentially leading to data exfiltration, account takeover, and in some cases, remote code execution (RCE). Attackers can exploit this to read sensitive data from the database, compromise user credentials, and potentially execute arbitrary commands on the server (GitHub Advisory).

The vulnerability is exploitable by authenticated users with rights to add/edit FAQ entries. Proof of Concept exploits have been demonstrated using both the insertentry and saveentry endpoints, where manipulated email and notes parameters can be used to execute SQL commands such as pg_sleep(5) to verify the injection (GitHub Advisory).

The vulnerability has been patched in phpMyFAQ version 3.2.6. The fix involves proper escaping of values in the affected functions, as demonstrated in the patch commit (GitHub Patch).