The vulnerability is a LIKE wildcard injection in phpMyFAQ’s Search.php before version 4.1.1. The searchCustomPages() method uses real_escape_string() but does not escape SQL LIKE metacharacters % and _, allowing attackers to inject these wildcards into search queries. This causes the database to match records that were not intended to be returned, resulting in unauthorized disclosure of FAQ content. The weakness is identified as CWE‑943.

The flaw affects the open‑source phpMyFAQ application published by thorsten. Any installation running a version earlier than 4.1.1, in particular 4.1.0 and older, is susceptible. The issue is fixed in phpMyFAQ 4.1.1.

The CVSS score of 6.9 indicates a moderate severity vulnerability. With an EPSS score below 1 % and no presence in the CISA KEV catalog, the likelihood of exploitation is low, but the impact remains significant for exposed FAQ data. An unauthenticated attacker can trigger the vulnerability by submitting crafted search terms through the web interface, which is a remote attack vector. Successful exploitation leads to partial data breach of FAQ entries that were not intended for public view.