High priorityDisclosed

Advisory · CVE-2026-109573

Unauthenticated SQL injection in phpMyFAQ search autocomplete

phpMyFAQ before 4.1.9 has an SQL injection flaw in its autocomplete escaping that unauthenticated attackers can reach through the search parameter when the database runs in NO_BACKSLASH_ESCAPES mode, exposing credentials and configuration secrets. CVSS 3.1 8.1, CVSS 4.0 9.2.

Advisory published October 13, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-109573
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

phpMyFAQ escapes quotes in a way some database modes ignore, so a visitor can slip a quote into search and start asking the database questions directly.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Public search

    An unauthenticated attacker calls the api/autocomplete endpoint with a crafted search parameter.

  2. 02Escaping mismatch

    A Unicode quote is normalized to an ASCII quote, and in NO_BACKSLASH_ESCAPES mode the backslash escaping is treated literally.

  3. 03Database access

    The injection lets the attacker read credentials and configuration secrets, modify records, or drop tables.

What happened

The phpMyFAQ project disclosed CVE-2026-109573 for versions before 4.1.9. The PdoMysql escaping routine escapes single quotes with backslashes, which are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. An unauthenticated attacker can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to reach SQL injection (CWE-89).

Per the vendor’s affected data, upgrade to 4.1.9 or later. The flaw’s reach depends on the database mode, but the upgrade does not.

What to do

  1. Inventory every phpMyFAQ deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to phpMyFAQ while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for autocomplete requests containing quote characters or SQL syntax, database errors in phpMyFAQ logs, and unexpected reads of credential tables.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

FAQ sites look harmless and hold admin credentials and configuration secrets. If yours runs in the affected database mode, assume the database was readable and rotate accordingly.