Executive brief
phpMyFAQ is an open-source web application used to create and manage frequently asked questions (FAQ) pages. A security flaw in the search functionality allows unauthorized users to bypass search filters and view content they are not supposed to see. By using special characters in search queries, an attacker can force the system to reveal all custom pages, potentially exposing sensitive information.
Technical details
The vulnerability exists in the searchCustomPages() method within phpmyfaq/src/phpMyFAQ/Search.php. While the application uses real_escape_string() to sanitize search terms, this function does not escape SQL LIKE metacharacters such as '%' and '_'. An unauthenticated attacker can inject these wildcards into search queries (e.g., using '_%_') to bypass intended search filters and match unintended records in the 'faqcustompages' table. This results in the disclosure of custom page content that should not be surfaced. The issue is addressed in version 4.1.1 by properly escaping these metacharacters.
Affected products
- thorsten phpMyFAQ < 4.1.1
Timeline
- 2026-03-31: patched: Version 4.1.1 released
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34973 published to NVD