CVE-2024-56199

Executive Summary

CVE-2024-56199 is a medium-severity vulnerability in phpMyFAQ, an open-source FAQ web application. An authenticated attacker with editor privileges can inject malicious HTML into the FAQ editor, leading to a persistent Denial of Service (DoS) condition. By injecting malformed HTML elements (e.g., overlapping divs, iframes, or buttons) that cover the entire viewport, the attacker can render the FAQ page unusable for legitimate users. This can also be leveraged for phishing or defacement attacks. The vulnerability affects versions 3.2.10 through 4.0.1 and is patched in version 4.0.2.

Supply Chain & Package Security

phpMyFAQ is distributed as a PHP application via GitHub and its official website. No package manager (NPM, PyPI, Go, Ruby) is involved. The vulnerability is introduced in the application's own codebase, not in a third-party dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 5.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires editor-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – page content can be altered
• Availability Impact: High (A:H) – page rendered unusable

Threat Level: Medium. Exploitation requires authenticated access with editor privileges, but the impact on availability is significant.

Deep Dive & Mechanics

The vulnerability resides in the FAQ editor functionality at /admin/index.php?action=editentry. The application fails to sanitize user-supplied HTML content before storing it in the database. When the FAQ entry is rendered on the public page, the injected HTML is executed in the browser.

An attacker can inject elements such as:

• A <div> with position: fixed; top: 0; left: 0; width: 100%; height: 100%; z-index: 9999; to cover the entire page.
• Overlapping <iframe> elements that load malicious or distracting content.
• Buttons or forms that mimic legitimate UI elements for phishing.

Because the injection is stored in the database, every visitor to the affected FAQ page will experience the DoS condition until the malicious entry is removed.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.0.2): The editor likely uses $_POST['content'] directly without sanitization, or uses a function like htmlspecialchars() incorrectly.

// Vulnerable: direct storage of user input
$content = $_POST['content'];
$db->query("UPDATE faq_data SET content = '$content' WHERE id = $id");

Patched Code (4.0.2): The patch introduces proper HTML sanitization, likely using a library like HTMLPurifier or a custom function to strip dangerous tags and attributes.

// Patched: sanitize input before storage
$content = $_POST['content'];
$cleanContent = strip_tags($content, '<p><a><ul><ol><li><strong><em>'); // whitelist safe tags
$db->query("UPDATE faq_data SET content = '$cleanContent' WHERE id = $id");

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a phpMyFAQ instance (version 3.2.10 to 4.0.1)
• Valid editor-level credentials

Exploitation Steps:

1. Log in to the admin panel.
2. Navigate to http://target/admin/index.php?action=editentry&id=X (where X is an existing FAQ entry ID).
3. In the content field, inject the following payload:

<div style="position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;background:white;">
  <h1>Site Under Maintenance</h1>
  <p>Please enter your password to continue:</p>
  <input type="password" name="phish">
  <button onclick="alert('Phished!')">Submit</button>
</div>

4. Save the entry. The public FAQ page will now display the overlay, causing a DoS and potential phishing.

Alternative Payload (Defacement):

<iframe src="https://attacker.com/defaced" style="position:fixed;top:0;left:0;width:100%;height:100%;border:none;"></iframe>

Blue Team

Detection:

• Monitor for unusual HTML content in FAQ entries, especially elements with position: fixed or z-index values.
• Look for iframes pointing to external domains.
• Check for sudden changes in FAQ page layout reported by users.

Hunting:

• Query the database for FAQ entries containing <iframe, position:fixed, or z-index:.
• Review admin access logs for repeated edits to the same FAQ entry.

Mitigation:

• Immediately remove malicious FAQ entries from the database.
• Apply the patch by upgrading to version 4.0.2.
• If immediate upgrade is not possible, implement a WAF rule to block HTML injection in the editor.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin/index.php?action=editentry containing HTML with position:fixed or z-index.
• Host: Database entries in the faq_data table containing <iframe, position:fixed, or z-index:.
• Logs: Admin access logs showing repeated edits to the same FAQ entry within a short time frame.
• File: No specific file IOCs; the attack is stored in the database.

Detection Engineering

YARA Rule

rule phpmyfaq_html_injection_cve_2024_56199 {
    meta:
        description = "Detects HTML injection payloads targeting phpMyFAQ CVE-2024-56199"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56199"
    strings:
        $payload1 = /position\s*:\s*fixed/i
        $payload2 = /z-index\s*:\s*\d{4,}/i
        $payload3 = /<iframe/i
        $payload4 = /style\s*=\s*"[^"]*width\s*:\s*100%[^"]*height\s*:\s*100%/i
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: phpMyFAQ HTML Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject malicious HTML into phpMyFAQ editor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: /admin/index.php?action=editentry
        http.body|contains: 
            - 'position:fixed'
            - 'z-index:'
            - '<iframe'
    condition: selection
falsepositives:
    - Legitimate use of iframes for embedding videos (rare in FAQ editor)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-56199 phpMyFAQ HTML Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/index.php?action=editentry"; http_uri;
    content:"position:fixed"; http_client_body;
    content:"z-index:"; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to phpMyFAQ version 4.0.2 or later.
2. If upgrade is not possible, manually sanitize all existing FAQ entries in the database to remove malicious HTML.
3. Restrict editor privileges to trusted users only.

Long-term Measures:

• Implement a Content Security Policy (CSP) to block inline styles and iframes from unknown sources.
• Use HTMLPurifier or similar library to sanitize all user input in the editor.
• Conduct regular security audits of the application code.
• Enable logging of all admin actions and monitor for anomalies.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.