CVE-2026-56738
Deferred Deferred - Pending Action

SQL Injection in phpMyFAQ StopWord Management

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the "word" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-10-05
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-13
NVD
CVE-2026-56738
EUVD
EUVD-2026-86289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in phpMyFAQ versions prior to 4.1.6. The StopWords::add() method builds a SQL INSERT statement using sprintf() and inserts user-supplied stop word values directly without escaping. This allows authenticated administrators to inject malicious SQL code via the 'word' parameter.

Detection Guidance

Check phpMyFAQ logs for suspicious SQL query patterns or failed database operations. Review admin access logs for unusual activity in the stop-word management feature. Use database query logs to detect unexpected INSERT or UPDATE statements with malicious payloads.

Impact Analysis

An attacker with admin access could exploit this to execute arbitrary SQL commands. This may lead to data exfiltration, database modification, or even deletion of database tables like faqstopwords. The impact depends on database permissions and stored data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Both standards require protection against unauthorized data access.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.6 or later to apply the fix. If upgrading is not possible, manually apply the escaping fix from the commit referenced in Resource 1. Temporarily restrict access to the stop-word management feature for non-essential admin users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56738. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart