Cloudanix VulnDB

GHSA-289f-fq7w-6q2w

Critical · 9.8

phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

CVSS

9.8

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

`BuiltinCaptcha::garbageCollector()` and `BuiltinCaptcha::saveCaptcha()` at `phpmyfaq/src/phpMyFAQ/Captcha/BuiltinCaptcha.php:298` and `:330` interpolate the `User-Agent` header and client IP address into DELETE and INSERT queries with `sprintf` and no escaping. Both methods run on every hit to the public `GET /api/captcha` endpoint, which requires no authentication. An unauthenticated attacker sets the `User-Agent` header to a crafted SQL payload and runs `SLEEP()`, `BENCHMARK()`, or time-based blind extraction against the database that backs phpMyFAQ. Verified live against 4.2.0-alpha (master at `b9f25109`): baseline request 147 ms, request with `User-Agent: x' OR SLEEP(2) OR 'x` 4.09 s (two `SLEEP(2)` calls, one per vulnerable sink).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities