Executive brief
phpMyFAQ, an open-source FAQ software, contains a critical security flaw in its CAPTCHA system. An unauthenticated attacker can send a specially crafted web request to steal sensitive information from the database, including administrator credentials and system configuration details. This could lead to a full takeover of the FAQ platform and exposure of private data.
Technical details
An unauthenticated SQL injection vulnerability exists in phpMyFAQ versions prior to 4.1.2. The issue resides in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods, which use sprintf() to interpolate the 'User-Agent' HTTP header directly into DELETE and INSERT SQL queries without sanitization or parameterization. Attackers can trigger this by sending a crafted User-Agent header to the public /api/captcha endpoint. This enables time-based blind SQL injection, allowing for the extraction of sensitive data such as bcrypt password hashes from the 'faquser' table and SMTP credentials from 'faqconfig'. The vulnerability is resolved in version 4.1.2.
Affected products
- thorsten phpMyFAQ < 4.1.2
Timeline
- 2026-04-28: advisory: Original advisory GHSA-289f-fq7w-6q2w published
- 2026-05-15: disclosed: NVD publication of CVE-2026-46364
- 2026-06-08: other: Duplicate advisory GHSA-ch9q-c9mp-j5gq withdrawn