phpMyFAQ before version 4.1.9 contains an SQL injection flaw in the PdoMysql::escape() routine. The routine incorrectly escapes single quotes when the database server runs in NO_BACKSLASH_ESCAPES mode, allowing a crafted Unicode right single quotation mark to be normalized to a literal ASCII quote. This injection can be performed via the publicly accessible api/autocomplete endpoint and grants an unauthenticated attacker read access to credentials and configuration secrets, the ability to modify records, or even drop tables. This weakness is a classic SQL injection, identified as CWE-89.

The vulnerability applies to phpMyFAQ releases prior to 4.1.9 from Thorsten. It requires a MySQL or MariaDB database configured with the NO_BACKSLASH_ESCAPES option and exposure of the api/autocomplete endpoint. Any installation of phpMyFAQ on such a database is vulnerable, regardless of the operating system, as the vulnerability resides in the PHP code.

The CVSS score of 9.2 classifies the flaw as critical. The EPSS score is not available, but the lack of authentication and the simplicity of sending a crafted GET request to the endpoint mean exploitation is straightforward for automated scanners. The vulnerability is not listed in the CISA KEV catalog. Attackers can execute the exploit without needing elevated privileges or prior access, making it a high‑risk threat to systems where phpMyFAQ is exposed to the network.