{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phpmyfaq--4.1.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109573"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["phpMyFAQ (\u003c 4.1.9)"],"_cs_severities":["high"],"_cs_tags":["web-application","sql-injection","cve"],"_cs_type":"advisory","_cs_vendors":["phpMyFAQ"],"content_html":"\u003cp\u003ephpMyFAQ versions prior to 4.1.9 are susceptible to a critical SQL injection vulnerability within the \u003ccode\u003ePdoMysql::escape()\u003c/code\u003e function. The flaw occurs because the function attempts to sanitize inputs by escaping single quotes with backslashes; however, this mechanism fails when the backend MySQL or MariaDB database is configured with the \u003ccode\u003eNO_BACKSLASH_ESCAPES\u003c/code\u003e SQL mode. In this environment, the backslashes are treated as literal characters rather than escape sequences.\u003c/p\u003e\n\u003cp\u003eUnauthenticated attackers can exploit this by sending a specially crafted Unicode right single quotation mark in the \u003ccode\u003esearch\u003c/code\u003e parameter of the \u003ccode\u003eapi/autocomplete\u003c/code\u003e API endpoint. The application normalizes this character into an ASCII single quote, successfully bypassing the intended sanitization. If successfully exploited, this vulnerability provides an attacker with the ability to perform unauthorized credential extraction, leak configuration secrets, modify existing records, or drop entire database tables. Organizations running phpMyFAQ should upgrade to version 4.1.9 or later immediately to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated remote attackers to achieve unauthorized access to the application's backend database. This may result in full data exfiltration, including administrative credentials and system configuration, as well as destructive actions such as record modification or complete table deletion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade phpMyFAQ to version 4.1.9 or later immediately to resolve the vulnerable \u003ccode\u003ePdoMysql::escape()\u003c/code\u003e implementation.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests directed at \u003ccode\u003eapi/autocomplete\u003c/code\u003e containing Unicode characters or suspicious SQL syntax within the \u003ccode\u003esearch\u003c/code\u003e query parameter.\u003c/li\u003e\n\u003cli\u003eReview database configurations to determine if \u003ccode\u003eNO_BACKSLASH_ESCAPES\u003c/code\u003e is enabled, as this setting amplifies the impact of the vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T00:31:30Z","date_published":"2026-10-13T00:31:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-sql-injection/","summary":"An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.","title":"SQL Injection in phpMyFAQ via PdoMysql::escape()","url":"https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpMyFAQ (\u003c 4.1.9)","version":"https://jsonfeed.org/version/1.1"}