LIKE Wildcard Injection Vulnerability in phpMyFAQ with PostgreSQL Support

CVE-2026-76212

What is CVE-2026-76212?

An issue in phpMyFAQ versions before 4.1.7 allows for a LIKE wildcard injection when using PostgreSQL with the pgsql PHP extension. Specifically, the issue arises from an incorrect LIKE ESCAPE character declaration in the Search/Database/Pgsql.php backend. This misconfiguration results in user-supplied wildcards, such as '%' and '_', being processed without escaping, allowing an unauthenticated attacker to submit these characters through the public FAQ search form. Consequently, attackers can generate broad pattern matches that lead to performance degradation and denial of service. However, this vulnerability does not facilitate quote-breaking SQL injection or data exfiltration, as the PDO PostgreSQL backend remains unaffected and quotes are adequately escaped.

References