CVE-2026-109573: phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
phpMyFAQ deployments before 4.1.9 are exposed when their MySQL or MariaDB server uses NO_BACKSLASH_ESCAPES mode. The affected request path is the api/autocomplete search endpoint.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can target the endpoint remotely, and no user interaction is required.
What input is used to trigger the injection?
The attacker sends a Unicode right single quotation mark in the search parameter. It is normalized to an ASCII quote, while the application's backslash-based escaping is ineffective under NO_BACKSLASH_ESCAPES mode.
What can an attacker do after successful exploitation?
The vulnerability can allow reading credentials and configuration secrets, modifying records, or dropping tables. This affects confidentiality, integrity, and availability.