phpMyFAQ CVE-2026-46364

Exploitation requires only that the phpMyFAQ instance is running a version below 4.1.2 and that the public GET /api/captcha endpoint is reachable by the attacker - this endpoint is enabled by default and requires no authentication, no user interaction, and no special configuration. The only limiting factors are network reachability to the application and the database backend supporting the SLEEP() or BENCHMARK() function (MySQL, MariaDB, PostgreSQL with pg_sleep adaptation); deployments behind authenticated reverse proxies, IP allowlists, or WAFs that drop suspicious User-Agent headers would block the attack path.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H gives 9.3 - network-reachable, low-complexity, no privileges, no user interaction, with high confidentiality/integrity/availability impact on the vulnerable component. SSVC reinforces this with Automatable: yes and Technical Impact: total, meaning a single HTTP request can fully compromise the database. However, EPSS sits at only 0.05% (15th percentile) and SSVC Exploitation is rated 'none', indicating no observed exploitation activity yet despite the trivial mechanics. Not in CISA KEV. The mismatch between high CVSS/automatability and low EPSS is typical for freshly disclosed open-source CVEs where mass scanning has not yet ramped - defenders running phpMyFAQ should treat this as a high real-world priority because the preconditions (unauth endpoint + verified time-based blind extraction at 4 seconds per probe) make weaponization straightforward.

An attacker locates an internet-exposed phpMyFAQ instance and issues a single GET request to /api/captcha with User-Agent set to a time-based blind payload such as x' OR SLEEP(2) OR 'x, observing a ~4 second response (two SLEEP calls, one per vulnerable sink) versus a ~150ms baseline. They then script bit-by-bit extraction of the faquser, faqconfig, and related tables to harvest admin password hashes, API tokens, and SMTP credentials, which are subsequently used to log into the admin panel or pivot to mail-based phishing. The GHSA writeup includes a working PoC payload, making automation with sqlmap or a custom script trivial.