Executive brief
phpMyFAQ, a popular open-source FAQ software, contains a security flaw that allows anyone on the internet to access or modify its database without a password. By sending a specially crafted web request, an attacker can steal sensitive information like administrator login credentials, email settings, and private FAQ content. This could lead to a total takeover of the FAQ system or the deletion of important data.
Technical details
An unauthenticated SQL injection vulnerability exists in phpMyFAQ's BuiltinCaptcha.php. The `garbageCollector()` and `saveCaptcha()` methods use `sprintf()` to interpolate the `User-Agent` HTTP header and client IP address directly into SQL DELETE and INSERT queries without proper escaping or parameterization. These methods are triggered by any GET request to the `/api/captcha` endpoint. An attacker can exploit this to perform time-based blind SQL injection to exfiltrate sensitive data (such as bcrypt password hashes from the `faquser` table) or modify/delete database records. The vulnerability is patched in version 4.1.2.
Affected products
- thorsten phpMyFAQ <= 4.1.1
Timeline
- 2026-04-28: disclosed: Initial disclosure to vendor
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-06: patched: Fix released in version 4.1.2