Executive brief
phpMyFAQ, an open-source FAQ software, is vulnerable to a security flaw that could allow an attacker to take control of its database. By using a specially crafted name in an external login service like Azure AD, an attacker can execute unauthorized database commands. This could lead to the theft of sensitive user information, modification of FAQ content, or full access to administrative accounts.
Technical details
A SQL injection vulnerability exists in `phpmyfaq/src/phpMyFAQ/User/CurrentUser.php` within the `setTokenData()` method. The application uses `sprintf` to build a SQL UPDATE statement using OAuth token fields (`refresh_token`, `access_token`, `code_verifier`, and `jwt`) without proper escaping via `$db->escape()`. While `json_encode()` is used for the JWT field, it does not escape single quotes, allowing an attacker to break out of the SQL string literal. The vulnerability is reachable via the Azure AD (Entra ID) OAuth flow; an attacker can register a malicious display name or claim in their identity provider which is then processed by phpMyFAQ during login. This allows for arbitrary SQL execution, potentially leading to data exfiltration or administrative account takeover. The issue is fixed in version 4.1.2.
Affected products
- thorsten phpMyFAQ <= 4.1.1
Timeline
- 2026-04-28: disclosed
- 2026-05-06: advisory: GitHub Advisory published
- 2026-04-28: patched: Version 4.1.2 released