phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards. Version 4.2.0-alpha patches the issue.

Affected: Packagist: thorsten/phpmyfaq

### Summary

An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards.

### Details

The vulnerable endpoint is: ``` GET /api/chat/users?q=... ``` Source: ```php // phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php $query = trim($request->query->get('q', ''));

if (mb_strlen($query) < 2) { return $this->json([ 'success' => true, 'users' => [], ], Response::HTTP_OK); }

$chat = new Chat($this->configuration); $users = $chat->searchUsers($query, $this->currentUser->getUserId()); ``` Sink: ```php // phpmyfaq/src/phpMyFAQ/Chat.php $escapedTerm = $this->configuration->getDb()->escape(mb_strtolower($searchTerm));

$query = sprintf( "SELECT u.user_id, ud.display_name FROM %sfaquser u LEFT JOIN %sfaquserdata ud ON u.user_id = ud.user_id WHERE u.user_id != %d AND u.user_id > 0 AND LOWER(ud.display_name) LIKE '%%%s%%' AND u.account_status = 'active' LIMIT %d", Database::getTablePrefix(), Database::getTablePrefix(), $excludeUserId, $escapedTerm, $limit, ); ``` `escape()` prevents SQL string breakout, but it does not escape SQL `LIKE` metacharacters. Therefore, attacker-contr…