The flaw occurs when phpMyFAQ uses the native pgsql PHP extension with a wrongly specified LIKE escape character, causing user input escaped with '|', but the ESCAPE character is '='. This makes wildcard escaping ineffective, letting % and _ remain as active SQL LIKE wildcards. An attacker can inject these characters into the public FAQ search form, forcing the database to perform broad pattern matches and expensive sequential scans. The result is a denial‑of‑service condition. The backend correctly escapes quotes, so the bug does not lead to SQL injection or data exfiltration.

The issue affects all installations of phpMyFAQ earlier than version 4.1.7 when the application is configured to use PostgreSQL through the native pgsql PHP extension. The PDO PostgreSQL backend is not impacted.

The CVSS score of 6.9 indicates a high severity due to potential downtime. EPSS is not available, but the lack of authentication requirements means any user can trigger the flaw. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would leverage the public FAQ search interface to submit wildcards, a straightforward path that does not require prior access.