CVE-2026-47132: 
PHP Análise e mitigação de vulnerabilidades

CVE-2026-47132 is a SQL LIKE wildcard injection vulnerability in phpMyFAQ's chat user search feature that allows any authenticated user to bypass the intended display-name search filter and enumerate all active users. It affects phpMyFAQ versions prior to 4.2.0-alpha (specifically the main branch up to commit c0b7158). The vulnerability was published on August 8, 2026, and patched on August 12, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-20) and insufficient neutralization of SQL LIKE metacharacters (CWE-89) in phpmyfaq/src/phpMyFAQ/Chat.php. The searchUsers() method calls escape() on user-supplied input, which prevents SQL string breakout but does not escape the % and _ LIKE wildcard characters. These characters are then embedded directly into a LIKE '%%%s%%' clause without an ESCAPE clause, allowing an attacker to send crafted queries such as GET /api/chat/users?q=%25%25 (URL-encoded %%) or q=__ to match all active users. Notably, the codebase already applies the correct ESCAPE '|' pattern with wildcard escaping in other query paths, but this chat search endpoint was overlooked (GitHub Advisory, Fix Commit).

Successful exploitation allows any authenticated user to enumerate all active user accounts, exposing user IDs and display names that may include staff names, department identifiers, or other sensitive organizational information (CWE-200). While the vulnerability does not enable direct data modification or system compromise, the disclosed user enumeration data could facilitate targeted phishing, social engineering, or credential-stuffing attacks against identified accounts. Availability is not impacted (GitHub Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, including a video demonstration, making exploitation trivial for any authenticated user. The vulnerability requires only a valid authenticated session and low attack complexity, with no user interaction needed. No evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported at this time (GitHub Advisory).

1. Obtain authentication: Acquire any valid authenticated user account on the target phpMyFAQ instance (e.g., a self-registered or low-privilege account).
2. Identify the vulnerable endpoint: Confirm the target is running phpMyFAQ on a version prior to 4.2.0-alpha by checking version indicators or response headers.
3. Send a baseline query: Issue a normal search request that should return no results to confirm endpoint behavior: GET /api/chat/users?q=zz with a valid session cookie. Expect an empty users array in the JSON response.
4. Inject LIKE wildcard payload: Send a crafted request using URL-encoded % wildcards: GET /api/chat/users?q=%25%25 (decoded: %%). Alternatively, use underscore wildcards: GET /api/chat/users?q=__.
5. Harvest user data: The response will return all active users' userId and displayName fields, bypassing the intended name-filter logic and exposing the full active user list (GitHub Advisory).

• Network: Repeated HTTP GET requests to /api/chat/users with query parameters containing %25%25, %%, __, or other wildcard patterns from a single authenticated session.
• Logs: Web server access logs showing requests to /api/chat/users?q=%25%25 or /api/chat/users?q=__; unusually high volume of chat user search API calls from a single user account.
• Application Behavior: Chat user search returning the full active user list in response to non-specific or wildcard queries rather than targeted name matches (GitHub Advisory).

The fix is available in phpMyFAQ 4.2.0-alpha (commit bd4b08b). The patch escapes LIKE metacharacters (%, _, and |) before interpolation and adds an ESCAPE '|' clause to the SQL query, consistent with the safer pattern already used elsewhere in the codebase. Administrators should upgrade to 4.2.0-alpha or apply the patch commit immediately. No configuration-based workaround is available; upgrading is the only remediation (Fix Commit, GitHub Advisory).