Business information leak In phpmyfaq/phpmyfaq
Description
phpMyFAQ: Public API endpoints expose emails and invisible questions
Summary
Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).
Details
OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.
PoC
curl -i -H 'Accept-Language: en' \ http://192.168.40.16/phpmyfaq/api/v3.0/open-questions
Impact
Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.0.17 | ||
packagist | 4.0.17 |
Aliases
1. 2. 3. 4. 5.
References
1.