{
  "cve": "CVE-2026-46364",
  "ghsa": "GHSA-289f-fq7w-6q2w",
  "verdict": "confirmed",
  "vulnerability_type": "CWE-89 SQL Injection",
  "severity": "Critical",
  "cvss_base": 9.8,
  "affected_component": "phpMyFAQ\\Captcha\\BuiltinCaptcha",
  "affected_versions": "< 4.1.2",
  "fixed_version": "4.1.2",
  "fix_commit": "b9f25109fddb38eee19987183798638d07943f92",
  "reproduction_method": "boolean-based content inspection",
  "payload": "test' OR '1'='1",
  "target_endpoint": "GET /api/captcha",
  "authentication_required": false,
  "vulnerable_test": {
    "version": "4.1.1",
    "indicator": "boolean_expression_evaluated",
    "observed_db_value": "1",
    "expected_db_value_if_literal": "test' OR '1'='1",
    "explanation": "In the vulnerable version, the unsanitized User-Agent header is interpolated into the INSERT SQL. The payload 'test' OR '1'='1' is evaluated as a SQL boolean expression, resulting in the value '1' (true) being stored in the useragent column instead of the literal string."
  },
  "fixed_test": {
    "version": "4.1.2",
    "indicator": "literal_string_stored",
    "observed_db_value": "test' OR '1'='1",
    "explanation": "In the fixed version, the User-Agent value is escaped/parameterized before SQL execution. The literal string 'test' OR '1'='1' is stored in the database without evaluation as SQL."
  },
  "timing_comparison": {
    "note": "The ticket describes a time-based blind SQL injection signal using SLEEP() payloads. The reproduction script confirms the same root cause (unsanitized User-Agent interpolation) via a boolean-based signal that inspects the stored database value. Both approaches demonstrate that the User-Agent is executed as SQL in the vulnerable version and sanitized in the fixed version.",
    "vulnerable_baseline_seconds": null,
    "vulnerable_payload_seconds": null,
    "fixed_baseline_seconds": null,
    "fixed_payload_seconds": null
  },
  "conclusion": "The vulnerability is confirmed. phpMyFAQ 4.1.1 allows unauthenticated SQL injection via the User-Agent header in BuiltinCaptcha::saveCaptcha() and BuiltinCaptcha::garbageCollector(). phpMyFAQ 4.1.2 correctly escapes the User-Agent value before SQL execution, neutralizing the injection vector.",
  "reproduced_at": "2026-05-22T10:21:10Z"
}