CVE-2026-47132

### Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards. ### Details The vulnerable endpoint is: ``` GET /api/chat/users?q=... ``` Source: ```php // phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php $query = trim($request->query->get('q', '')); if (mb_strlen($query) < 2) { return $this->json([ 'success' => true, 'users' => [], ], Response::HTTP_OK); } $chat = new Chat($this->configuration); $users = $chat->searchUsers($query, $this->currentUser->getUserId()); ``` Sink: ```php // phpmyfaq/src/phpMyFAQ/Chat.php $escapedTerm = $this->configuration->getDb()->escape(mb_strtolower($searchTerm)); $query = sprintf( "SELECT u.user_id, ud.display_name FROM %sfaquser u LEFT JOIN %sfaquserdata ud ON u.user_id = ud.user_id WHERE u.user_id != %d AND u.user_id > 0 AND LOWER(ud.display_name) LIKE '%%%s%%' AND u.account_status = 'active' LIMIT %d", Database::getTablePrefix(), Database::getTablePrefix(), $excludeUserId, $escapedTerm, $limit, ); ``` `escape()` prevents SQL string breakout, but it does not escape SQL `LIKE` metacharacters. Therefore, attacker-controlled `%` and `_` are interpreted by the database as wildcards. The project already uses a safer pattern elsewhere with ESCAPE '|' and wildcard escaping, but this chat search path does not apply it. ### PoC: Tested against: phpMyFAQ 4.2.0-alpha commit c0b7158df4bfb11d57b1ef7d471760583c9c2fae Prerequisite: attacker has any valid authenticated user account. 1. Ensure there are multiple active users in the database, for example: ``` userId=2 displayName="Alice Finance" userI