CVE-2026-34973 Details
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure. This issue has been patched in version 4.1.1.
A wildcard injection vulnerability has been identified in phpMyFAQ versions prior to 4.1.1. The issue arises in the searchCustomPages() method of Search.php, where real_escape_string() is used to sanitize search terms before they are added to SQL LIKE clauses. However, this function does not escape SQL LIKE metacharacters such as % and _, which can be exploited by an unauthenticated attacker. By injecting these wildcards into search queries, it is possible to match unintended records and access content that should not be disclosed, leading to unauthorized information exposure.
Users can update to phpMyFAQ version 4.1.1 or later, where this vulnerability has been patched. In version 4.1.1, the searchCustomPages() method has been updated to properly escape SQL LIKE metacharacters before executing the search.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 | [email protected] | Product |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gcp9-5jc8-976x | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpmyfaq phpmyfaq | 4.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |