PT-2026-41361 · Phpmyfaq · Phpmyfaq

Adrgs · Published 2026-05-06 · Updated 2026-05-15 · CVE-2026-46359

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description An issue exists in the setTokenData() function of the CurrentUser class that allows authenticated attackers to execute arbitrary SQL commands. This occurs by injecting malicious OAuth token claims. Specifically, attackers using Azure AD accounts that contain SQL metacharacters in their display names or JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—can break out of string literals to execute unauthorized database queries.

Recommendations Update to version 4.1.2 or later. As a temporary workaround, restrict the use of the setTokenData() function or limit OAuth token claims from untrusted providers until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-46359

GHSA-P9WC-4PJV-RG82

GHSA-PM8C-3QQ3-72W7

Affected Products

Phpmyfaq

References · 7

• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7 · Exploit
• https://osv.dev/vulnerability/GHSA-p9wc-4pjv-rg82 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm8c-3qq3-72w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46359 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://t.me/cveNotify/163691 · Telegram Post
• https://vulncheck.com/advisories/phpmyfaq-sql-injection-in-currentuser-settokendata-via-unescaped-oauth-token-fields · Note