Description
phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the "word" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue.
Published: 2026-09-24
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The phpMyFAQ web application contains a flaw in the StopWords::add() method that constructs an SQL INSERT statement with sprintf() without escaping user input. This omission allows an authenticated administrator to embed SQL code that breaks out of the string literal, potentially dropping tables, modifying data, or extracting information from the database. The vulnerability is a classic SQL injection (CWE‑89) that compromises database integrity and confidentiality.

Affected Systems

Thorsten: phpMyFAQ versions prior to 4.1.6 are vulnerable. All releases before 4.1.6 contain the unescaped add() method, and the bug was fixed in 4.1.6.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity. An EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an administrator, who can access the stop‑word management interface. Once authenticated, the attacker can execute arbitrary SQL against the database, facilitating data loss, corruption, or exfiltration.

Generated by OpenCVE AI on September 25, 2026 at 05:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade phpMyFAQ to version 4.1.6 or newer, which properly escapes stop word input.
  • Restrict access to the stop‑word management feature to trusted administrators and use a database account with the least privileges necessary for normal operation.
  • Validate and escape all user-supplied stop word values in any custom code interacting with StopWords::add(), and consider implementing prepared statements for future development.

Generated by OpenCVE AI on September 25, 2026 at 05:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rw77-vq4g-x3hp phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
History

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Thorsten
Thorsten phpmyfaq
Vendors & Products Thorsten
Thorsten phpmyfaq

Thu, 24 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the "word" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue.
Title phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Thorsten Phpmyfaq
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-05T15:33:34.610Z

Reserved: 2026-06-22T19:17:28.959Z

Link: CVE-2026-56738

cve-icon Vulnrichment

Updated: 2026-10-05T14:47:09.755Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T17:17:04.890

Modified: 2026-10-05T16:17:14.313

Link: CVE-2026-56738

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T06:00:13Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')