Insufficient Authentication for Email Change in phpMyFAQ

phpMyFAQ versions before 4.1.9 and 4.2.0-beta contain a critical authentication bypass vulnerability in the user control panel's email update functionality. The vulnerability stems from the application checking only session validity and CSRF token presence when users change their registered email address, but failing to verify the user's current password. This is a dangerous design flaw because email addresses are typically the gateway to account recovery—an attacker with a hijacked session can reassign the victim's email to an attacker-controlled mailbox, then leverage the password reset flow to gain full account control. This affects all phpMyFAQ installations, with particular risk to instances with superadmin or privileged accounts that lack two-factor authentication, potentially granting complete platform compromise.

While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's extended reasoning capabilities would identify attack patterns consistent with T1556 (Modify Authentication Process) and T1098 (Account Manipulation). A security practitioner using Casky would see detections focused on unauthorized account modifications—specifically flagging unexpected email changes in user profiles, session anomalies where email updates occur without password verification in the request logs, and credential reset flows triggered from atypical geographic or timing patterns. The platform's 754 mapped security skills would correlate these signals: detecting the absence of credential verification in sensitive account changes, identifying orphaned sessions with elevated permissions, and recognizing the classic post-compromise pattern of account takeover via email hijacking followed by forced password resets.