CVE-2026-109573GHSA-98P2-CG7P-H385
phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.9, 4.2.0-beta
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
Affected versions
- thorsten phpMyFAQ
fixed in 4.1.9; From 4.2.0-alpha · fixed in 4.2.0-beta