phpMyFAQ SQL Injection Flaw Rated Critical in National Vulnerability Database Record
An unauthenticated SQL injection in phpMyFAQ versions before 4.1.9 allows attackers to steal credentials and drop database tables.
Key points
- The flaw is tracked as CVE-2026-109573 with a CVSS score of 9.2.
- Attackers exploit the api/autocomplete endpoint using Unicode characters.
- The issue affects installations running MySQL or MariaDB in NO_BACKSLASH_ESCAPES mode.
The National Vulnerability Database lists CVE-2026-109573 as a critical security flaw in phpMyFAQ. This SQL injection vulnerability exists in versions prior to 4.1.9 and prior to 4.2.0-beta. The weakness allows unauthenticated attackers to compromise database integrity and steal sensitive information.
At a glance
- CVE
- CVE-2026-109573
- Product
- thorsten phpMyFAQ
- CVSS
- 9.2 Critical
- Weakness
- SQL injection
- Exploited
- No known exploitation
The vulnerability stems from how the PdoMysql::escape() function handles special characters. It escapes single quotes with backslashes, which MySQL or MariaDB treats literally when running in NO_BACKSLASH_ESCAPES mode. Attackers can bypass this by sending a Unicode right single quotation mark in the search parameter of the api/autocomplete endpoint. The system normalizes this character to an ASCII quote, breaking the intended escaping logic.
Technical Context and Impact
According to the NVD record, the flaw is classified under CWE-89, which denotes SQL injection weaknesses. The CVSS score is 9.2, placing it in the critical severity range. This high score reflects the ease of exploitation and the severe potential impact on confidentiality and integrity.
An attacker can use this method to read credentials and configuration secrets stored in the database. They can also modify existing records or drop tables entirely. Because the attack is unauthenticated, no login or valid session is required to trigger the exploit. The specific use of Unicode normalization makes the attack vector distinct from standard SQL injection attempts.
Affected Versions and Environments
The vulnerability affects phpMyFAQ versions before 4.1.9. It also impacts versions before 4.2.0-beta. The software is developed by Thorsten. Administrators must check their current version against these cutoffs to determine exposure.
The exploit specifically requires the database backend to be MySQL or MariaDB. Furthermore, the database must be configured to run in NO_BACKSLASH_ESCAPES mode. If the database uses a different mode or a different engine, the specific backslash escaping issue may not manifest. However, the presence of the vulnerable code in the application remains a risk factor.
What should you do?
Administrators should immediately verify their phpMyFAQ version. If the version is older than 4.1.9, they are affected by this critical flaw. Users should also check their database configuration to see if NO_BACKSLASH_ESCAPES is enabled. Monitoring logs for unusual activity on the api/autocomplete endpoint is recommended.
What to do and how to stay safe: phpMyFAQ
- Check your phpMyFAQ version and upgrade to 4.1.9 or later if available.
- Review database logs for requests to the api/autocomplete endpoint containing Unicode characters.
- Verify if your MySQL or MariaDB instance is configured with NO_BACKSLASH_ESCAPES mode.
- Restrict access to the API endpoints using firewall rules or web application firewalls.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109573?
The National Vulnerability Database assigns a CVSS score of 9.2 to this vulnerability.
Which phpMyFAQ versions are affected by this SQL injection?
Versions before 4.1.9 and versions before 4.2.0-beta are affected.
How do attackers exploit this vulnerability?
Attackers send a Unicode right single quotation mark in the search parameter of the api/autocomplete endpoint, which is normalized to an ASCII quote.
