Executive brief
phpMyFAQ, an open-source FAQ software, contains a vulnerability in its chat user search feature. An authenticated user can bypass search filters to view a list of all active users, including their IDs and display names. This could lead to the exposure of internal staff identities, department names, or other sensitive account information.
Technical details
The vulnerability exists in the `ChatController.php` and `Chat.php` components of phpMyFAQ. While the application uses an `escape()` method to prevent standard SQL string breakout, it fails to neutralize SQL `LIKE` metacharacters such as `%` and `_` in the `searchTerm` parameter of the `/api/chat/users` endpoint. An authenticated attacker can provide these wildcards to bypass the intended search logic and retrieve all active user records from the `faquser` and `faquserdata` tables. This issue is addressed in version 4.2.0-alpha by implementing proper wildcard escaping.
Affected products
- thorsten phpMyFAQ < 4.2.0-alpha
Timeline
- 2026-08-08: disclosed
- 2026-08-08: patched: Patched in version 4.2.0-alpha via commit bd4b08b
- 2026-08-12: advisory