CyberRota Analysis
AI-GeneratedphpMyFAQ versions prior to 4.1.7 are vulnerable to a SQL injection flaw that allows authenticated users with glossary add or edit permissions to inject arbitrary SQL commands via specially crafted payloads. This vulnerability can lead to unauthorized access to sensitive database information, posing a significant risk to data integrity and confidentiality. Organizations using affected versions should prioritize patching this issue to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.
Related CVEs
Other vulnerabilities affecting the same vendor(s)