CyberRota Analysis
AI-GeneratedThe vulnerability affects phpMyFAQ versions prior to 4.1.8, allowing an attacker with a hijacked session to bypass two-factor authentication (TOTP) by disabling it without needing to re-enter a password or provide a current TOTP code. This could lead to unauthorized access to user accounts, including those of administrators, significantly compromising account security. Organizations using phpMyFAQ should prioritize patching to mitigate the risk of session hijacking and unauthorized account access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactor_enabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.