CVE-2026-47132: 
PHP vulnerability analysis and mitigation

CVE-2026-47132 is a SQL LIKE wildcard injection vulnerability in phpMyFAQ's chat user search feature that allows any authenticated user to bypass the intended display-name search filter and enumerate all active users. It affects phpMyFAQ versions prior to 4.2.0-alpha (specifically the main branch up to commit c0b7158df4bfb11d57b1ef7d471760583c9c2fae). The vulnerability was published on August 8, 2026, and added to the GitHub Advisory Database on August 12, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-20) and insufficient neutralization of SQL LIKE metacharacters (CWE-89) in phpmyfaq/src/phpMyFAQ/Chat.php. The searchUsers() method calls escape() on user-supplied input, which prevents SQL string breakout but does not escape the % and _ LIKE wildcard characters. These unescaped characters are then embedded directly into a LIKE '%%%s%%' clause in the SQL query, allowing an attacker to craft queries that match all active users. Notably, the phpMyFAQ codebase already implements a safer pattern using ESCAPE '|' with wildcard escaping in other code paths, but this was not applied to the chat search endpoint. A public PoC is included in the advisory, demonstrating exploitation via URL-encoded wildcard payloads (GitHub Advisory, Fix Commit).

Successful exploitation allows any authenticated user to enumerate all active user IDs and display names in the phpMyFAQ instance, bypassing the intended search filter. This may expose internal user identities, staff names, department names, or other sensitive account information depending on the deployment context (CWE-200). There is no direct availability impact, and while the integrity impact is rated low, the primary risk is unauthorized disclosure of user account data that could facilitate further targeted attacks such as phishing or credential stuffing (GitHub Advisory).

A working proof-of-concept is publicly available and included in the GitHub Security Advisory, including a video demonstration. Exploitation requires only a valid authenticated session — no elevated privileges are needed. The CVE status is currently listed as "Reserved" and there is no evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing at this time. No EPSS score is currently published (GitHub Advisory).

1. Obtain authenticated access: Log in to the target phpMyFAQ instance with any valid user account (no administrative privileges required).
2. Identify the vulnerable endpoint: Confirm the instance is running a version prior to phpMyFAQ 4.2.0-alpha by checking version indicators or response headers.
3. Send a baseline query: Issue a normal search request to confirm the endpoint is active and returns empty results for a non-matching term:

   GET /api/chat/users?q=zz HTTP/1.1
   Host: target
   Cookie: [authenticated session]

4. Inject LIKE wildcard payload: Send a request with URL-encoded %% (decoded: %%) to trigger the wildcard match against all active users:

   GET /api/chat/users?q=%25%25 HTTP/1.1
   Host: target
   Cookie: [authenticated session]

5. Enumerate users: The server returns a JSON array of all active user IDs and display names, bypassing the intended name-filter logic. Alternatively, use __ (two underscores) to match any two-character display names:

   GET /api/chat/users?q=__ HTTP/1.1
   Host: target
   Cookie: [authenticated session]

6. Refine enumeration: Use targeted _ patterns (e.g., _____ for five-character names) to narrow results and systematically enumerate users by name length (GitHub Advisory).

• Network: Repeated GET requests to /api/chat/users with q parameter values containing %25%25, %%, __, or sequences of underscores from a single authenticated session.
• Logs: Web server access logs showing requests to /api/chat/users?q=%25%25 or /api/chat/users?q=__; unusually high volume of chat user search API calls from a single user account in a short time window.
• Application Behavior: Chat user search returning large lists of users in response to short or wildcard-only query strings rather than targeted name fragments (GitHub Advisory).

The fix is available in phpMyFAQ 4.2.0-alpha (commit bd4b08b). The patch escapes LIKE metacharacters (%, _, and |) before interpolation and adds ESCAPE '|' to the SQL LIKE clause, consistent with the safer pattern already used elsewhere in the codebase. Administrators should upgrade to phpMyFAQ 4.2.0-alpha or later immediately. No configuration-based workaround is available; upgrading is the only remediation (Fix Commit, GitHub Advisory).