CVE-2026-46364: phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

Overview

CVE-2026-46364 affects phpMyFAQ before version 4.1.2. The flaw is an SQL injection in the BuiltinCaptcha class, specifically in the garbageCollector() and saveCaptcha() methods, which place User-Agent request header values into DELETE and INSERT statements without adequate sanitization. The record classifies the weakness as CWE-89 (SQL Injection).

Impact

According to the description in the record, the flaw can be reached without authentication through the public GET /api/captcha endpoint. The record states that this could allow time-based blind SQL injection and extraction of sensitive data such as user credentials, administrator tokens and SMTP credentials. The CNA VulnCheck assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the SSVC fields in the record indicate automatable exploitation and total technical impact.

Affected products and versions

• Product: Thorsten phpMyFAQ
• Affected range in the record: versions before 4.1.2
• Fixed version: not listed explicitly in the record; the upper bound of the affected range suggests 4.1.2 is the first fixed release, which should be checked against the vendor advisory.

Exploitation status

The KEV catalog field in the record is false, so this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability of 0.0212 (percentile 0.81387) is a statistical estimate and is not evidence of exploitation. The SSVC exploitation field is recorded as none.

Remediation and mitigation

• Upgrade phpMyFAQ to version 4.1.2 or later, as the affected range indicates this is the first fixed release.
• Review the vendor advisory and the patch commit linked below to confirm the fix scope before rollout.
• Restrict or monitor public access to the captcha endpoint while upgrades are scheduled, for example through a web application firewall or reverse proxy rules.
• Limit the database account used by phpMyFAQ to the privileges it needs, reducing what an injection could reach.
• If exposure is suspected, rotate user passwords, administrator tokens and SMTP credentials stored in the application database.

Detection guidance

• Review web server and application logs for requests to /api/captcha that carry unusually long, malformed or non-standard User-Agent values.
• Watch for abnormal response time patterns on the captcha endpoint, since the record describes a time-based technique.
• Audit database logs for unexpected DELETE or INSERT statements originating from the captcha component.
• Check for unexplained changes to user accounts, administrator tokens or SMTP settings.

Limitations of the available information

The record does not list a fixed version explicitly, and the fixes field is empty. The commit tagged as a patch and the vendor advisory are referenced, but this analysis did not verify their contents. The record does not state whether public proof-of-concept code exists, and it does not indicate whether any deployment has been compromised. These points remain unknown.

Frequently asked questions

Which phpMyFAQ versions are affected by CVE-2026-46364?

The record lists phpMyFAQ versions before 4.1.2 as affected. Upgrading to 4.1.2 or later is the main remediation step.

Is CVE-2026-46364 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.