Critical SQL Injection in phpMyFAQ Lets Attackers Steal Credentials
Unauthenticated attackers can exploit CVE-2026-109573 to access secrets in phpMyFAQ versions prior to 4.1.9, according to the National Vulnerability Database record.
Key points
- The flaw is rated Critical with a CVSS score of 9.2 in the National Vulnerability Database.
- Attackers exploit a normalization issue in the search parameter of the autocomplete API.
- Versions of phpMyFAQ before 4.1.9 and before 4.2.0-beta are affected by this vulnerability.
The National Vulnerability Database recorded a critical SQL injection flaw in phpMyFAQ on a recent update cycle. This vulnerability, identified as CVE-2026-109573, allows unauthenticated attackers to compromise database integrity and steal sensitive information from systems running older versions of the software.
The flaw resides in the PdoMysql::escape() function within phpMyFAQ. According to the NVD record, this function escapes single quotes using backslashes. However, when MySQL or MariaDB operates in NO_BACKSLASH_ESCAPES mode, these backslashes are treated literally rather than as escape characters. This discrepancy creates a pathway for injection attacks.
How the Attack Works
Attackers can exploit this weakness by sending a Unicode right single quotation mark in the search parameter of the api/autocomplete endpoint. The system normalizes this Unicode character into a standard ASCII quote. Because the escaping mechanism fails to handle this specific conversion correctly under certain database configurations, the input is not properly sanitized.
This allows the attacker to inject SQL commands into the database query. The consequences are severe for the affected system. An attacker can read user credentials and configuration secrets stored in the database. They can also modify existing records or drop tables entirely, potentially causing significant data loss or service disruption for the organization.
Who Is Affected
The vulnerability impacts installations of phpMyFAQ that have not been updated to the latest secure version. According to the advisory, any version before 4.1.9 is vulnerable to this attack. Additionally, versions prior to 4.2.0-beta are also affected. Organizations using these older releases must verify their current version immediately to determine their exposure risk.
Defender's checklist
Security teams should audit their phpMyFAQ installations to confirm they are running version 4.1.9 or later. If an update is not possible, administrators should review database configurations to ensure NO_BACKSLASH_ESCAPES mode is disabled if feasible. Monitoring logs for unusual activity in the autocomplete API endpoint can also help detect potential exploitation attempts before significant damage occurs.
What to do and how to stay safe: phpMyFAQ
- Verify your phpMyFAQ version and upgrade to 4.1.9 or later as soon as possible.
- Review database settings to disable NO_BACKSLASH_ESCAPES mode if your environment allows it.
- Monitor access logs for suspicious requests targeting the api/autocomplete endpoint.
- Restrict public access to administrative interfaces where possible to reduce exposure.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-109573?
The vulnerability is rated Critical with a CVSS score of 9.2 according to the National Vulnerability Database.
Which versions of phpMyFAQ are vulnerable?
All versions before 4.1.9 and before 4.2.0-beta are affected by this SQL injection flaw.
How do attackers exploit this vulnerability?
Attackers send a Unicode right single quotation mark in the search parameter, which is normalized to an ASCII quote, bypassing the escape function.
