An authenticated SQL LIKE wildcard injection exists in phpMyFAQ 4.2.0-alpha in the chat user search endpoint (/api/chat/users?q=...). The vulnerability occurs because the search term is escaped to prevent SQL string syntax injection but does not escape the SQL LIKE wildcards '%' and '_'. Consequently, these wildcards remain active in the query, allowing an attacker to bypass the intended display-name filter and enumerate active users. The vulnerable code constructs a SQL query using a LIKE clause with the user-supplied input embedded directly after escaping string syntax but before escaping LIKE wildcards. The project uses a safer escaping pattern with ESCAPE '|' elsewhere, but this is not applied here. The impact is information disclosure of active user IDs and display names to any authenticated user. The issue was confirmed with a proof of concept and local testing.

Any authenticated user can enumerate active user IDs and display names through the chat user search endpoint by injecting SQL LIKE wildcards into the search query. This leads to unauthorized disclosure of internal user identities, including staff names and department information, depending on deployment. The vulnerability does not allow modification or deletion of data but compromises confidentiality of user information.

A patch is available for this vulnerability. Users should upgrade to a fixed version of phpMyFAQ that properly escapes SQL LIKE wildcards in the chat user search functionality. Until patched, avoid exposing the chat user search API to untrusted authenticated users or implement additional filtering to neutralize '%' and '_' characters in search queries. Check the vendor advisory or official phpMyFAQ repository for the specific patch and upgrade instructions.