CVE-2026-34973: CVE-2026-34973: LIKE Wildcard Injection in phpMyFAQ Search Component

#security #cve #cybersecurity

CVE-2026-34973: LIKE Wildcard Injection in phpMyFAQ Search Component

Vulnerability ID: CVE-2026-34973
CVSS Score: 6.9
Published: 2026-04-01

phpMyFAQ versions prior to 4.1.1 contain a LIKE wildcard injection vulnerability in the searchCustomPages() method. The application fails to properly neutralize SQL LIKE metacharacters, allowing unauthenticated attackers to bypass intended search constraints and trigger unauthorized information disclosure.

TL;DR

Unauthenticated attackers can exploit a LIKE wildcard injection (CWE-943) in phpMyFAQ < 4.1.1 by passing '%' or '_' characters to the search function, resulting in the disclosure of hidden or unintended database records.

Technical Details

CWE ID: CWE-943
Attack Vector: Network / Unauthenticated
CVSS v4.0: 6.9
Impact: Information Disclosure
Exploit Status: None
CISA KEV: Not Listed

Affected Systems

phpMyFAQ Search Component
LAMP/LEMP Stack Applications running vulnerable phpMyFAQ versions
phpMyFAQ: < 4.1.1 (Fixed in: 4.1.1)

Mitigation Strategies

Software Upgrade
Web Application Firewall (WAF) Rules
Code Review for LIKE Clause Usage

Remediation Steps:

Backup the existing phpMyFAQ installation and backend database.
Download phpMyFAQ version 4.1.1 or later from the official vendor repository.
Deploy the updated codebase to the target web server environment.
Verify the integrity of the search functionality by supplying normal queries.
Validate the fix by submitting searches containing '%' to ensure only literal matches are returned.