phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

High

## Summary The `StopWords::add()` method in phpMyFAQ builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string **without calling the application's database escaping function** on it. A sibling method, `StopWords::update()`, which modifies an *existing* stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path.

Remediation

Upgrade phpmyfaq/phpmyfaq to 4.1.6 or later. Upgrade thorsten/phpmyfaq to 4.1.6 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-rw77-vq4g-x3hp

← All threats