https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 00:44:15 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02342 bdu:2024-02342 https://cve.radiocsirt.org/vuln/bdu:2024-02342 https://cve.radiocsirt.org/vuln/euvd-2026-158339 EUVD-2026-158339 https://cve.radiocsirt.org/vuln/euvd-2026-158339 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28105 <p>phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.</p> <p>phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-28105 https://cve.radiocsirt.org/vuln/ghsa-pwh2-fpfr-x5gf <p><strong>Affected:</strong> Packagist: phpmyfaq/phpmyfaq</p> <p>### Summary The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system.</p> <p>### Details In the file upload function of the category image, the `Content-type` can be manipulated to return an empty string for the extension and the `lang` parameter can be set to `.php.` to allow an attacker to save a file as `.PHP`. This allows the uploading of web shells which could lead to RCE on phpmyfaq.</p> <p>### PoC 1. Generate a fake .GIF file that contains a php command using the tool `gifsicle` a. Cmd: `gifsicle &lt; test1.gif --comment &#34;&lt;?php system(&#39;whoami&#39;); ?&gt;&#34; &gt; output.php.gif` </p> <p>b. The contents of the file should look like this: </p> <p>2. Browse to “../phpmyfaq/admin/?action=addcategory” and upload the fake .GIF file </p> <p>3. Intercept the upload request and modify the params below and forward it: 3a. `lang` parameter to `.php.` 3b. `Content-Type` parameter from `image/gif` to `image/gif2`</p> <p> on the system.</p> <p>### Details In the file upload function of the category image, the `Content-type` can be manipulated to return an empty string for the extension and the `lang` parameter can be set to `.php.` to allow an attacker to save a file as `.PHP`. This allows the uploading of web shells which could lead to RCE on phpmyfaq.</p> <p>### PoC 1. Generate a fake .GIF file that contains a php command using the tool `gifsicle` a. Cmd: `gifsicle &lt; test1.gif --comment &#34;&lt;?php system(&#39;whoami&#39;); ?&gt;&#34; &gt; output.php.gif` </p> <p>b. The contents of the file should look like this: </p> <p>2. Browse to “../phpmyfaq/admin/?action=addcategory” and upload the fake .GIF file </p> <p>3. Intercept the upload request and modify the params below and forward it: 3a. `lang` parameter to `.php.` 3b. `Content-Type` parameter from `image/gif` to `image/gif2`</p> <p>![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/9247c5bb-8f58-41de-a5d4-8…</p> https://cve.radiocsirt.org/vuln/ghsa-pwh2-fpfr-x5gf https://cve.radiocsirt.org/vuln/gsd-2024-28105 gsd-2024-28105 https://cve.radiocsirt.org/vuln/gsd-2024-28105