phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.

Affected: Packagist: phpmyfaq/phpmyfaq

### Summary The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system.

### Details In the file upload function of the category image, the `Content-type` can be manipulated to return an empty string for the extension and the `lang` parameter can be set to `.php.` to allow an attacker to save a file as `.PHP`. This allows the uploading of web shells which could lead to RCE on phpmyfaq.

### PoC 1. Generate a fake .GIF file that contains a php command using the tool `gifsicle` a. Cmd: `gifsicle < test1.gif --comment "<?php system('whoami'); ?>" > output.php.gif` 

b. The contents of the file should look like this: 

2. Browse to “../phpmyfaq/admin/?action=addcategory” and upload the fake .GIF file 

3. Intercept the upload request and modify the params below and forward it: 3a. `lang` parameter to `.php.` 3b. `Content-Type` parameter from `image/gif` to `image/gif2`

![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/9247c5bb-8f58-41de-a5d4-8…