phpMyFAQ versions prior to 4.1.6 are susceptible to remote code execution when an authenticated administrator with specific privileges manipulates the configuration API.

The application fails to properly validate the source of packages within the configuration API. An authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can upload a malicious ZIP file and force the system to extract it into the application root, leading to code execution.

An attacker with administrative privileges can leverage this flaw to elevate their access to the underlying server. This compromise enables full control over the application environment, potentially leading to data theft or further lateral movement within the network. With a CVSS score of 9.4, the risk of total system compromise is extremely high.

Immediate Action: Update thorsten phpMyFAQ to version 4.1.6 or later to ensure the configuration API enforces proper integrity checks.

Proactive Monitoring: Audit administrative user activity and monitor for unusual file system changes within the application directory.

Compensating Controls: Implement strict role-based access control (RBAC) to ensure that only trusted personnel hold the configuration and attachment management privileges required to trigger this exploit.

Public Exploit Available: No confirmed public exploit (weaponized or curated) is available in the provided data.

Although this vulnerability requires administrative privileges, the potential for remote code execution makes it a high-priority item. Administrators should audit current user permissions and apply the 4.1.6 update immediately to prevent potential internal abuse or account takeover scenarios.