The phpMyFAQ web application is vulnerable to an SQL LIKE wildcard injection in its chat user search endpoint. Because the application escapes the usual SQL string delimiters but fails to sanitize the '%' and '_' characters, an authenticated user can craft a search term that expands into a pattern matched by all database records. This allows the user to enumerate the usernames or display names of all active users. The flaw does not provide direct data leakage beyond identifiers nor does it enable code execution, but it exposes a modest amount of user information that could be useful for follow‑on attacks.

All installations of the open source phpMyFAQ application distributed by the vendor thorsten, specifically any version earlier than 4.2.0‑alpha that includes the chat user search feature. The vulnerability affects all environments that deploy this code and allow users to log in and access the chat search interface.

The vulnerability carries a CVSS base score of 5.4, indicating a moderate impact. There is no EPSS value available, and the flaw is not included in CISA’s KEV catalog. Because the privilege requirement is authenticated, the attack vector is internal or privileged user. The impact is limited to enumeration of active users; no disclosure of more sensitive data or remote code execution is possible. Exploitation requires a logged‑in user with access to the chat search, which is typically a regular user or administrator and therefore does not increase the risk profile significantly beyond the moderate score.