SQL Injection in phpMyFAQ via PdoMysql::escape()

phpMyFAQ versions prior to 4.1.9 are susceptible to a critical SQL injection vulnerability within the PdoMysql::escape() function. The flaw occurs because the function attempts to sanitize inputs by escaping single quotes with backslashes; however, this mechanism fails when the backend MySQL or MariaDB database is configured with the NO_BACKSLASH_ESCAPES SQL mode. In this environment, the backslashes are treated as literal characters rather than escape sequences.

Unauthenticated attackers can exploit this by sending a specially crafted Unicode right single quotation mark in the search parameter of the api/autocomplete API endpoint. The application normalizes this character into an ASCII single quote, successfully bypassing the intended sanitization. If successfully exploited, this vulnerability provides an attacker with the ability to perform unauthorized credential extraction, leak configuration secrets, modify existing records, or drop entire database tables. Organizations running phpMyFAQ should upgrade to version 4.1.9 or later immediately to mitigate this risk.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to achieve unauthorized access to the application's backend database. This may result in full data exfiltration, including administrative credentials and system configuration, as well as destructive actions such as record modification or complete table deletion.

Recommendation

• Upgrade phpMyFAQ to version 4.1.9 or later immediately to resolve the vulnerable PdoMysql::escape() implementation.
• Monitor web server logs for HTTP requests directed at api/autocomplete containing Unicode characters or suspicious SQL syntax within the search query parameter.
• Review database configurations to determine if NO_BACKSLASH_ESCAPES is enabled, as this setting amplifies the impact of the vulnerability.