CVE-2026-46364 | THREATINT

Description

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

PUBLISHED Reserved 2026-05-13 | Published 2026-05-15 | Updated 2026-05-15 | Assigner VulnCheck

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

Any version before 4.1.2

affected

4.1.2 (semver)

unaffected

Credits

adrgs reporter

aisafe-bot finder

References

github.com/...pMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w (GHSA Advisory GHSA-289f-fq7w-6q2w) vendor-advisory

github.com/...ommit/b9f25109fddb38eee19987183798638d07943f92 patch

www.vulncheck.com/...via-user-agent-header-in-builtincaptcha (VulnCheck Advisory: phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha) third-party-advisory

cve.org (CVE-2026-46364)

nvd.nist.gov (CVE-2026-46364)

Download JSON