Executive brief
phpMyFAQ is an open-source FAQ software platform. A vulnerability in its authentication system allows an attacker to execute unauthorized database commands by using a specially crafted account name or profile information during the login process. This could lead to the theft of sensitive user data, modification of FAQ content, or full administrative takeover of the platform.
Technical details
A SQL injection vulnerability exists in phpMyFAQ's CurrentUser::setTokenData() method within src/phpMyFAQ/User/CurrentUser.php. The application uses sprintf() to build an UPDATE statement using OAuth token fields (refresh_token, access_token, code_verifier, and JWT claims) without proper escaping via the database driver. While json_encode() is used on JWT data, it does not escape single quotes, allowing an attacker to break out of the SQL string literal. An attacker can exploit this by registering an account with a malicious display name or JWT claim (e.g., through Azure AD/Entra ID) that contains SQL metacharacters. Successful exploitation allows for arbitrary database read/write access. The issue is fixed in version 4.1.2 by implementing proper escaping for all interpolated values.
Affected products
- thorsten phpMyFAQ < 4.1.2
Timeline
- 2026-04-28: advisory: Original advisory GHSA-pm8c-3qq3-72w7 published
- 2026-05-15: disclosed: CVE-2026-46359 assigned and published to NVD
- 2026-06-09: other: Duplicate advisory GHSA-p9wc-4pjv-rg82 withdrawn