thorsten/phpmyfaq: CSRF Allows Unauthorized Database Migrations via /admin/api/update-database

Summary

The POST /admin/api/update-database endpoint performs database migrations without requiring a CSRF token.

The endpoint only checks the global CONFIGURATION_EDIT permission and does not invoke the CSRF token validation mechanism used by other update-related endpoints.

Reproduction

Tested on phpMyFAQ 4.1.8.

A user with only the editconfig / CONFIGURATION_EDIT permission was logged in. The following request was sent without any CSRF token:

POST /admin/api/update-database HTTP/1.1
Host: localhost:8080
Cookie: PHPSESSID=<u_conf-session>
Content-Type: application/json

{}

The server returned:

{"success":"Database successfully updated."}

The database migration was executed successfully despite the absence of a CSRF token.

Root Cause

updateDatabase() does not call Token::verifyToken().

Other update-related endpoints use isValidUpdatePackageToken(), but the same protection is not applied to update-database.

Impact

An attacker can potentially trigger database migrations in a victim's authenticated browser through a cross-site request.

Depending on the database state and migration being executed, this can cause database integrity or availability issues.

The endpoint is also accessible to users with the delegated CONFIGURATION_EDIT permission rather than being restricted to superadmins.

Remediation

Require a page-scoped CSRF token before executing database migrations:

if (!Token::getInstance($this->container->get('session'))
    ->verifyToken('update-database', $data->csrf)) {
    return $this->json(
        ['error' => Translation::get('msgNoPermission')],
        Response::HTTP_UNAUTHORIZED
    );
}

The authorization requirements for sensitive update operations should also be reviewed separately.