An unauthenticated information disclosure vulnerability in phpMyFAQ allows remote attackers to exfiltrate sensitive database credentials, posing a significant risk to application integrity.

This vulnerability is an exposure of sensitive information (CWE-202) occurring because the application fails to restrict access to the configuration backup endpoint. An unauthenticated attacker can invoke the backup function via a POST request and subsequently download the resulting ZIP archive from a public directory.

The exposure of the database.php file grants an attacker direct access to database credentials, which typically leads to full database compromise and potential remote code execution on the underlying server. Given the CVSS score of 7.5, this high severity flaw could result in complete data exfiltration and the total loss of confidentiality for the FAQ system.

Immediate Action: Upgrade to phpMyFAQ version 4.0.16 or later to apply the necessary access controls on the backup API endpoint.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /api/setup/backup and monitor for unexpected file downloads originating from the application directory.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to block all public access to the /api/setup/backup endpoint until the software can be patched.

Public Exploit Available: Unknown (A Nuclei detection template exists, but no weaponized exploit or published Proof-of-Concept write-up is currently confirmed).

The ability for an unauthenticated user to retrieve cleartext database credentials represents a critical security failure that must be addressed immediately. Organizations currently running versions of phpMyFAQ earlier than 4.0.16 should prioritize the update process, as the lack of authentication requirements significantly lowers the barrier for exploitation by malicious actors.