CVE-2024-55889

Deeper analysis

phpMyFAQ is an open source FAQ web application that contains a vulnerability in its FAQ Record component prior to version 3.2.10. The flaw permits a privileged attacker to force an unintended file download on a visiting user's system by embedding a crafted reference inside an <iframe> element, which triggers automatically without user interaction or consent. The issue is tracked as CWE-451 and carries a CVSS 3.1 score of 4.9 reflecting network attack vector, low complexity, high privileges required, and high integrity impact with no confidentiality or availability effects.

An authenticated administrator or other high-privileged user can exploit the weakness by placing the iframe in content that a victim will view, resulting in the browser initiating a file download on the victim's machine. Because the vector requires no user interaction and works across the network, the attacker can achieve unauthorized modification of the victim's local environment through forced downloads.

The project addressed the issue in release 3.2.10. The accompanying GitHub Security Advisory GHSA-m3r7-8gw7-qwvc and the referenced commit fa0f7368dc3288eedb1915def64ef8fb270f711d document the fix and recommend that administrators upgrade promptly to eliminate the iframe-based download behavior.

EPSS for the CVE remains at 0.0919 with no material increase from its initial value, indicating limited observed exploitation interest to date.