The flaw occurs when phpMyFAQ uses the native pgsql PHP extension with a wrongly specified LIKE escape character, causing user input escaped with '|', but the ESCAPE character is '='. This makes wildcard escaping ineffective, letting % and _ remain as active SQL LIKE wildcards. An attacker can inject these characters into the public FAQ search form, forcing the database to perform broad pattern matches and expensive sequential scans. The result is a denial‑of‑service condition. The backend correctly escapes quotes, so the bug does not lead to SQL injection or data exfiltration.

The issue affects all installations of phpMyFAQ earlier than version 4.1.7 when the application is configured to use PostgreSQL through the native pgsql PHP extension. The PDO PostgreSQL backend is not impacted.

The CVSS score of 6.9 indicates high severity for potential downtime. The EPSS score of < 1% reflects a very low current exploitation probability, yet the lack of authentication requirements allows any user to trigger the DoS. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. The likely attack vector involves submitting '%' and '_' characters via the public FAQ search form, a straightforward path that requires no special privileges or network access.