An unsanitized User‑Agent header is inserted directly into SQL statements in phpMyFAQ’s BuiltinCaptcha class, a classic SQL injection weakness (CWE‑89). Attackers can target the public /api/captcha endpoint with crafted requests, performing time‑based blind injection. This allows extraction of sensitive data such as user credentials, admin tokens, and SMTP configuration from the database. The flaw is exploitable without authentication, so any web client reaching the endpoint can attempt the attack.

This flaw exists in phpMyFAQ installations provided by thorsten. All versions earlier than 4.1.2 are affected, while 4.1.2 and later include the patch that sanitizes the User‑Agent field and removes the unsafe query code.

With a CVSS score of 9.3 the vulnerability is classified as critical. The EPSS score is now 1%, indicating a very low exploitation probability, and the issue is not yet listed in CISA’s KEV catalog, but the lack of an authentication requirement makes exploitation trivial for anyone who can reach the web service. Attackers can use publicly available tools to conduct time‑based blind SQL injection against the /api/captcha endpoint over HTTP, extracting confidential data without needing credentials.