ExploitPublished
phpMyFAQ 4.0.16 · Improper Authorization
Source Exploit-DB RSS Feed
0
Mentioned vulnerabilities
Severity
MediumRated by Threat Radar
Data as of 5 May 2026, 07:48 UTC
What to do
AI-suggested
Until an official fix is available, restrict access to the /api/setup/backup endpoint to only authorized admin users. Additionally, ensure that backup files are not publicly accessible via the web server to prevent unauthorized retrieval.
Description
phpMyFAQ 4.0.16 - Improper Authorization
Indicators of compromise
Exploit source code
# Exploit Title: phpMyFAQ <= 4.0.16 - Improper Authorization
# Google Dork: N/A
# Date: 2026-01-23
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage: https://www.phpmyfaq.de/
# Software Link: https://www.phpmyfaq.de/download/
# Version: <= 4.0.16 (REQUIRED)
# Tested on: Ubuntu 22.04, Apache 2.4.52, PHP 8.2.x, MariaDB 10.6.x
# CVE: CVE-2026-24421
## Summary
Authenticated non-admin users can call /api/setup/backup and trigger a configuration backup. The endpoint checks authentication but doe…References
Community reviews
Loading reviews…