# phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

Authenticated config-edit users in phpMyFAQ can inject SQL via unsanitized array keys in the edit[] form parameter, leaking database contents.

- Payout: Research
- Severity: high
- Program: phpMyFAQ
- Found by: XY20130630
- Disclosed: 2025-11-17
- CVE: CVE-2025-62519
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-fxm2-cmwj-qvx4
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-fxm2-cmwj-qvx4
- Tags: area:web domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:php technique:blind technique:source-review vuln:sqli

**Target:** POST /admin/api/configuration (ConfigurationTabController::save)
**Root cause:** The save() method trusts the keys of the edit[] array and passes them to Configuration::update(), which concatenates $name directly into the WHERE clause of an UPDATE query without escaping (only the value is escaped).
**Steps:**
1. Log in as admin with Configuration Edit permission and open Administration -> Configuration.
2. Toggle a setting, click Save, capture the POST to `/admin/api/configuration` with valid Cookie and `pmf-csrf-token`.
3. In Repeater, add a multipart part with name `edit[dummykey' and updatexml(1, concat(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT 0, 1), 0x7e), 1) and '1]` and value `true`, keeping the CSRF token part.
4. Send; observe 500 with XPATH error leaking table name (e.g. `~faq_faqadminlog~`).
5. Use time-based blind variants to extract further data if errors are suppressed.
**How found:** Code review of ConfigurationTabController::save and Configuration::update: noticed values were escaped but array keys were concatenated raw into the SQL WHERE clause.
**Exploitation:** A privileged config editor submits a crafted multipart form where the array key breaks out of the single-quoted WHERE clause, executing arbitrary SQL (error-based via updatexml or time-based blind) to read/modify/delete database contents; potential RCE depending on DB config.
**Escalation:** Full database compromise; possible RCE depending on database configuration (e.g. file write / stacked queries).
**Insight:** When auditing config/settings save handlers, check whether array keys (form field names) are escaped separately from values — many ORMs/frameworks escape values but concatenate keys into WHERE clauses.

## Proof of concept (copied exactly from the original report)

**Malicious multipart form-data key with updatexml injection**

```
------WebKitFormBoundaryRandomString
Content-Disposition: form-data; name="edit[dummykey' and updatexml(1, concat(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT 0, 1), 0x7e), 1) and '1]"

true
------WebKitFormBoundaryRandomString
```