CVE-2025-62519

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14	Release Notes
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) phpMyFAQ es una aplicación web de preguntas frecuentes (FAQ) de código abierto. Antes de la versión 4.0.14, una vulnerabilidad de inyección SQL autenticada en la funcionalidad principal de actualización de configuración de phpMyFAQ permite a un usuario privilegiado con permisos de 'Edición de Configuración' ejecutar comandos SQL arbitrarios. La explotación exitosa puede llevar a un compromiso total de la base de datos, incluyendo la lectura, modificación o eliminación de todos los datos, así como una posible ejecución remota de código dependiendo de la configuración de la base de datos. Este problema ha sido parcheado en la versión 4.0.14.

Information

Published : 2025-11-17 17:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-62519

Mitre link : CVE-2025-62519

CVE.ORG link : CVE-2025-62519

JSON object : View

Products Affected

phpmyfaq

phpmyfaq

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-62519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62519", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-17T16:59:03.386326Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"status": "affected", "version": "< 4.0.14"}]}]}], "published": "2025-11-17T17:15:50.400", "references": [{"url": "https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14."}, {"lang": "es", "value": "phpMyFAQ es una aplicaci\u00f3n web de preguntas frecuentes (FAQ) de c\u00f3digo abierto. Antes de la versi\u00f3n 4.0.14, una vulnerabilidad de inyecci\u00f3n SQL autenticada en la funcionalidad principal de actualizaci\u00f3n de configuraci\u00f3n de phpMyFAQ permite a un usuario privilegiado con permisos de 'Edici\u00f3n de Configuraci\u00f3n' ejecutar comandos SQL arbitrarios. La explotaci\u00f3n exitosa puede llevar a un compromiso total de la base de datos, incluyendo la lectura, modificaci\u00f3n o eliminaci\u00f3n de todos los datos, as\u00ed como una posible ejecuci\u00f3n remota de c\u00f3digo dependiendo de la configuraci\u00f3n de la base de datos. Este problema ha sido parcheado en la versi\u00f3n 4.0.14."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF708E85-987E-47EF-9052-5E615F13B527", "versionEndExcluding": "4.0.14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}