{
  "ticket_id": "CVE-2026-46364",
  "code_root": "external/phpmyfaq",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-46364",
    "advisory_id": "GHSA-289f-fq7w-6q2w",
    "advisory_url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w",
    "vendor": "thorsten",
    "product": "phpMyFAQ",
    "repo": "https://github.com/thorsten/phpMyFAQ"
  },
  "facts": {
    "cve_id": "CVE-2026-46364",
    "advisory_id": "GHSA-289f-fq7w-6q2w",
    "issue_summary": "Unauthenticated SQL injection in phpMyFAQ via the User-Agent HTTP header. BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() interpolate the unsanitized User-Agent header directly into DELETE and INSERT SQL queries. The public, unauthenticated 'GET /api/captcha' endpoint reaches this code, enabling unauthenticated time-based blind SQL injection.",
    "vulnerability_type": "SQL Injection (unauthenticated)",
    "suspected_cwe": ["CWE-89"],
    "affected_versions": "< 4.1.2",
    "fixed_versions": ["4.1.2"],
    "reproduce_version": "4.1.1",
    "verify_fixed_version": "4.1.2",
    "repo_url": "https://github.com/thorsten/phpMyFAQ.git",
    "fix_commit": "b9f25109fddb38eee19987183798638d07943f92",
    "code_root": "external/phpmyfaq",
    "language": "PHP",
    "ecosystem": "composer",
    "package": "thorsten/phpmyfaq",
    "affected_functions": ["BuiltinCaptcha::garbageCollector", "BuiltinCaptcha::saveCaptcha"],
    "vulnerable_endpoint": "GET /api/captcha",
    "attacker_access": "anonymous / unauthenticated - the /api/captcha endpoint is public.",
    "exploit_outline": "Send GET /api/captcha with a User-Agent HTTP header carrying a time-based SQL injection payload, e.g. User-Agent: ' OR SLEEP(3)-- -. The unsanitized header is interpolated into the DELETE/INSERT captcha queries, so the SLEEP executes server-side.",
    "vulnerable_indicator": "On phpMyFAQ 4.1.1, a GET /api/captcha request whose User-Agent header carries a SLEEP(3) payload returns with a measurable response delay of about 3 seconds; a benign User-Agent returns promptly.",
    "fixed_indicator": "On phpMyFAQ 4.1.2, the same request with the SLEEP(3) payload returns promptly with no measurable delay - the header is no longer interpolated into SQL.",
    "reproduction_requirements": "PHP runtime with a web server, a database (SQLite or MySQL) for phpMyFAQ, the phpMyFAQ application installed at the two versions, and an HTTP client able to set a custom User-Agent header. The observable indicator is response timing, so measure request latency for the payload vs a benign User-Agent.",
    "notes": "Use a MySQL/MariaDB backend so SLEEP() is available for the time-based payload, or an equivalent delay primitive for the configured database. The differentiator is purely timing: ~3s delay on 4.1.1, no delay on 4.1.2. The fix commit is b9f25109fddb38eee19987183798638d07943f92."
  }
}