GHSA-vrjr-p3xp-xx2x CVE-2024-54141

phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

High Packagist

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.49%; Chance of exploitation in the next 30 days. Higher than 42.43% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-209 Generation of Error Message Containing Sensitive Information
Fix: 4.0.0; Upgrade thorsten/phpmyfaq to this version or later

Description

Summary

Exposure of database (ie postgreSQL) server's credential when connection to DB fails.

Details

Exposed database credentials upon misconfig/DoS @ permalink: https://github.com/thorsten/phpMyFAQ/blob/main/phpmyfaq/src/phpMyFAQ/Setup/Installer.php#L694

PoC

When postgreSQL server is unreachable, an error would be thrown exposing the credentials of the database. For instance, when "http://<phpmyfaq-instance>:8080/setup/index.php" is hit when the database instance/server is down, then credentials are exposed, for instance:

( ! ) Warning: pg_connect(): Unable to connect to PostgreSQL server: connection to server at &quot;127.0.0.1&quot;, port 5432 failed: Connection refused Is the server running on that host and accepting TCP/IP connections? in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78
Call Stack
# Time Memory Function Location
1 0.0404 453880 {main}( ) .../index.php:0
2 1.1341 610016 phpMyFAQ\Setup\Installer->startInstall( $setup = ??? ) .../index.php:471
3 1.2113 611544 phpMyFAQ\Database\Pgsql->connect( $host = '127.0.0.1', $user = 'cvecve', $password = '<redacted>', $database = 'cvecve', $port = 5432 ) .../Installer.php:694
4 1.2113 611864 pg_connect( $connection_string = 'host=127.0.0.1 port=5432 dbname=cvecve user=cvecve password=<redacted>' ) .../Pgsql.php:78

( ! ) Fatal error: Uncaught TypeError: Cannot assign false to property phpMyFAQ\Database\Pgsql::$conn of type ?PgSql\Connection in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78
( ! ) TypeError: Cannot assign false to property phpMyFAQ\Database\Pgsql::$conn of type ?PgSql\Connection in /var/www/html/src/phpMyFAQ/Database/Pgsql.php on line 78
Call Stack
# Time Memory Function Location
1 0.0404 453880 {main}( ) .../index.php:0
2 1.1341 610016 phpMyFAQ\Setup\Installer->startInstall( $setup = ??? ) .../index.php:471
3 1.2113 611544 phpMyFAQ\Database\Pgsql->connect( $host = '127.0.0.1', $user = 'cvecve', $password = '<redacted>', $database = 'cvecve', $port = 5432 ) .../Installer.php:694

image

A way to force this would be to perform a denial of service on the database instance/server. When the db connection is refused, the credentials would show. The remote attacker can then use that to gain full control on the database.

Impact

This vulnerability exposes the credentials of the database and grants a remote attacker full control over the database.

First notified Snyk on 16 Jan 2024.

Affected versions

Packagist

Package	Vulnerable	Fixed in
thorsten/phpmyfaq	`< 4.0.0`	`4.0.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

thorsten/phpmyfaq Packagist → `4.0.0`

composer

composer require thorsten/phpmyfaq:^4.0.0

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Proof of concept

CVSS 3.1 8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: Low

Weakness

CWE-209: Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

How to prevent it

Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Implementation, Build and Compilation: Debugging information should not make its way into a production release.
Implementation, Build and Compilation: Debugging information should not make its way into a production release.
System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
System Configuration: Create default error pages or messages that do not leak any information.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-54141

Packages

github.com/thorsten/phpMyFAQ

Timeline

Dec 6, 2024 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-rw77-vq4g-x3hp phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion	High	Also affects thorsten/phpmyfaq
GHSA-8gpw-xvpf-hvx5 phpMyFAQ's two-factor authentication login bypasses the password factor	High	Also affects thorsten/phpmyfaq
GHSA-pgwp-vc7q-cvj3 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission	High	Also affects thorsten/phpmyfaq
GHSA-6pvm-2vjj-rx4w phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration	Medium	Also affects thorsten/phpmyfaq
GHSA-mf8r-wm2w-f8c5 phpMyFAQ public FAQ APIs expose inactive FAQ content	Medium	Also affects thorsten/phpmyfaq
GHSA-88g4-74f3-63x9 phpMyFAQ has Potential Authenticated Path Traversal in PDF Export	Medium	Also affects thorsten/phpmyfaq
GHSA-pg62-f8g4-4wqh phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold	High	Also affects thorsten/phpmyfaq
GHSA-985r-q3qp-299h phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards	High	Also affects thorsten/phpmyfaq

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor