An unauthenticated attacker can insert unescaped percent and underscore characters into the search term of phpMyFAQ’s searchCustomPages() function. Because the function only applies real_escape_string, which does not escape SQL LIKE metacharacters, the database expands the pattern. This results in a SQL wildcard injection that causes the search to match unintended records, exposing FAQ content that should not have been disclosed.

Products affected are the open‑source FAQ application phpMyFAQ maintained by thorsten. All releases prior to version 4.1.1 are vulnerable, as the patch was applied in the 4.1.1 release.

Common Vulnerability Scoring System assigns a score of 6.9, indicating moderate severity. The EPSS metric is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only access to the public search interface; no authentication or additional privileges are needed. Because the wildcard characters are part of a normal user input field, attackers can mount automated requests to enumerate potentially sensitive records. The combination of unauthenticated access, easy injection, and lack of protection suggests a realistic threat profile.