CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to bypass guest submission restrictions in phpMyFAQ versions prior to 4.1.8, specifically through the question creation endpoint. This can lead to spam injection into the admin moderation queue, potentially overwhelming administrators with unwanted content. Organizations using affected versions should prioritize patching to mitigate the risk of spam and maintain the integrity of their moderation processes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.