Description

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T14:17:45.777Z",
  "pubdate": "2026-08-19T14:17:45.777Z",
  "executiveSummary": "An authenticated SQL injection vulnerability exists in phpMyFAQ prior to version 4.1.7, specifically within the glossary create and update endpoints. This security defect arises from improper handling of escaped strings before database insertion, allowing malicious SQL commands to be injected into the application backend.\nThe primary impact of this vulnerability is the potential exposure of sensitive database information to unauthorized actors. Attackers can leverage this flaw to extract confidential records, compromise data integrity, or potentially interact with the underlying database management system depending on database user privileges.\nThe affected product is phpMyFAQ in versions prior to 4.1.7. Risk implications are moderate to high due to the requirement of specific application privileges.\nTo successfully exploit this vulnerability, an attacker must possess authenticated access alongside explicit glossary add or edit permissions. The exploitation vector involves crafting specialized payloads containing dangling backslashes designed to neutralize string delimiters and escape sequences within SQL literals.",
  "technicalDetails": "The root cause of the vulnerability resides in the internal string processing logic of the glossary create and update endpoints within phpMyFAQ prior to version 4.1.7. Specifically, the vulnerability is triggered by truncating an escaped string improperly prior to embedding the resulting sequence directly into a SQL literal.\nThe vulnerable component comprises the application logic responsible for processing glossary entries during creation and modification operations. Affected software versions include all phpMyFAQ installations preceding version 4.1.7.\nAuthentication and privilege requirements dictate that the attacker must be an authenticated user possessing specific functional permissions, namely glossary add or edit capabilities. Network exposure is standard web-based accessibility to the phpMyFAQ application interface.\nExploitation occurs through a precise attack flow where the authenticated user supplies a maliciously crafted payload containing a dangling backslash. When the application escapes the input string and subsequently truncates it, the trailing backslash escapes the intended closing quote of the SQL literal string. This syntax manipulation breaks the SQL query boundary defined by the developers.\nConsequently, the remainder of the user-supplied payload is interpreted by the database engine as executable SQL commands rather than literal string data. This permits the injection of arbitrary SQL statements.\nThe post-exploitation impact includes unauthorized data retrieval, allowing attackers to read sensitive database information such as user credentials, session tokens, or other restricted application records stored within the backend database."
}