An unsanitized User‑Agent header is interpolated into SQL statements inside phpMyFAQ’s BuiltinCaptcha class, allowing attackers to send crafted requests to the public /api/captcha endpoint and perform a blind SQL injection. The injection can be leveraged to extract sensitive data, including user credentials, admin tokens, and SMTP configuration from the database. The flaw is exploitable without authentication, meaning any web client that can reach the endpoint can attempt the attack.

This flaw exists in phpMyFAQ installations provided by thorsten. All versions earlier than 4.1.2 are affected, while 4.1.2 and later include the patch that sanitizes the User‑Agent field and removes the unsafe query code.

With a CVSS score of 9.8 the vulnerability is classified as critical. The EPSS score is not reported and the issue is not yet listed in CISA’s KEV catalog, but the lack of an authentication requirement makes exploitation trivial for anyone who can reach the web service. Attackers can use publicly available tools to conduct time‑based blind SQL injection against the /api/captcha endpoint over HTTP, extracting confidential data without needing credentials.