Executive brief
phpMyFAQ is a popular FAQ management system used by organizations to publish knowledge bases and support documentation. An authenticated administrator can inject SQL code through the stop-words feature to read, modify, or delete database records—including sensitive data like user credentials and FAQ content—or cause service outages. The vulnerability exists because user input is not properly escaped before being inserted into a database query.
Technical details
The vulnerability is a SQL injection flaw in the `StopWords::add()` method in phpMyFAQ, where a stop-word value is inserted directly into a SQL query via `sprintf()` without calling the database escape function, while the identical `StopWords::update()` method correctly applies escaping to the same input type. An authenticated administrator reaching the stop-word management interface can craft a malicious stop word (e.g., `test', 'en'); DROP TABLE faqstopwords; --`) that breaks out of the SQL string literal and executes arbitrary SQL statements. Attack precondition is valid administrator credentials or an authenticated admin session; exploitation allows UNION-based and blind SQL injection to exfiltrate data, modify records, or drop tables depending on database user permissions and driver capabilities. The recommended fix is to apply the same escaping pattern already used elsewhere in the file, or migrate to parameterized prepared statements for defense in depth.
Affected products
- phpMyFAQ phpMyFAQ <unknown
Timeline
- 2026-09-24: disclosed
- 2026: other: CVE-2026-56738 assigned