Executive Summary

The vulnerability CVE-2026-34973 affects phpMyFAQ versions prior to 4.1.1 in the searchCustomPages() method. This method sanitizes user search terms using real_escape_string(), but this function does not escape SQL LIKE metacharacters '%' and '_'.

Because these wildcard characters remain unescaped, an unauthenticated attacker can inject them into search queries. This causes the SQL LIKE clauses to match a broader set of records than intended, including content that should not be accessible.

For example, searching for '_%_' can cause the query to return all custom pages containing at least one character, bypassing intended search restrictions and leading to unauthorized information disclosure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to inject wildcard characters into search queries, causing the application to return unintended records.

As a result, sensitive or restricted content from the custom pages can be disclosed to unauthorized users.

Since no authentication is required to exploit this issue, it poses a moderate risk of information disclosure, potentially exposing confidential or private data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the search functionality of phpMyFAQ versions prior to 4.1.1 for improper handling of SQL LIKE wildcard characters in search queries.

Specifically, you can attempt to submit search terms containing the SQL LIKE wildcards '%' and '_' to see if the search results include unintended or excessive content from the custom pages.

For example, submitting the search term '_%_' (underscore, percent, underscore) may cause the backend to execute a query that returns all custom pages containing at least one character, indicating the vulnerability.

There are no specific network commands provided, but you can manually test the web application's search interface or use tools like curl or wget to automate sending such search queries and observe the responses.

• Use curl to send a search request with the payload '_%_' and check if the response contains all custom pages, e.g.: curl -G 'http://your-phpmyfaq-site/search.php' --data-urlencode 'search=_%_'

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade phpMyFAQ to version 4.1.1 or later, where this vulnerability has been patched.

If upgrading is not immediately possible, you should ensure that the search terms are properly escaped before being used in SQL LIKE clauses.

Specifically, escape the '%' and '_' characters in search terms by replacing them with '\%' and '\_' respectively, for example using: $word = str_replace(['\', '%', '_'], ['\\', '\%', '\_'], $word);

Alternatively, use parameterized queries with correctly escaped LIKE values to prevent wildcard injection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to perform a LIKE wildcard injection in the search functionality of phpMyFAQ, leading to unauthorized disclosure of content from the faqcustompages table. Such information disclosure could potentially expose sensitive or personal data that the application was intended to protect.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, unauthorized information disclosure can lead to violations of these regulations if personal or sensitive data is exposed. Therefore, this vulnerability could negatively impact compliance by enabling data exposure that should be restricted under such standards.

Useful 0 Not Useful 0