Description
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | < 4.1.9, 4.2.0-alpha – < 4.2.0-beta | 4.1.9 |
References
- GitHub Security Advisory (GHSA-98p2-cg7p-h385) vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint third-party-advisory