phpMyFAQ: SQL injection via api/autocomplete search parameter
Summary
phpMyFAQ before 4.1.9 uses a faulty escape function (PdoMysql::escape()) that breaks when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. An unauthenticated attacker can send a crafted Unicode quote in the search parameter of api/autocomplete, which is converted to an ASCII quote and breaks out of the SQL statement. Successful exploitation allows reading credentials and configuration secrets, modifying records or dropping tables. The attack only works if the database runs in this non-default SQL mode.
Affected
- phpMyFAQ 0 to before 4.1.9
- phpMyFAQ 4.2.0-alpha to before 4.2.0-beta
- Precondition: MySQL or MariaDB with NO_BACKSLASH_ESCAPES SQL mode enabled
- Note: GitHub Advisory Database lists affected versions as unknown; confirm in the vendor advisory.
Fixed in
- Upgrade to phpMyFAQ 4.1.9 or later
- Upgrade to 4.2.0-beta or later for the 4.2 line
- Also upgrade to at least 4.1.2 to address CVE-2026-46364
Workaround
- No vendor workaround known.
- Check whether sql_mode on the database server includes NO_BACKSLASH_ESCAPES; without it the described condition is not met (not vendor-confirmed).
- Restrict access to api/autocomplete at the reverse proxy or WAF until patched (generic measure, not a documented vendor fix).
Exploitation
- CISA SSVC: exploitation status PoC, automatable: no, technical impact: total.
- Not listed in CISA KEV.
- EPSS about 0.34% (per cvedetails, citing VulnCheck).
- A third-party write-up describes the mechanism and includes PoC material; not verified.
- No confirmed in-the-wild exploitation found.
Our recommendation
- Inventory all phpMyFAQ instances, including those from web hosting packages.
- Upgrade to 4.1.9 or later (and at least 4.1.2 for CVE-2026-46364).
- Check the database sql_mode for NO_BACKSLASH_ESCAPES on each instance.
- Restrict access to api/autocomplete until patched if the instance is internet-facing.
- If an internet-facing instance was unpatched, rotate database credentials and review logs for suspicious requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-98p2-cg7p-h385 github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-109573 osv.dev
- GitHub Advisory Database GHSA-2v8j-hf72-c5w9 github.com
- Strix CVE-2026-109573 www.strix.ai
- CVE-2026-46364 (SentinelOne) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:40.
Original description (NVD)
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.