phpMyFAQ versions 4.0.13 and earlier contain an authenticated SQL injection vulnerability in the configuration update functionality. A privileged user with 'Configuration Edit' permissions can exploit this flaw by crafting malicious form parameter names, which are used unsafely in SQL queries. This allows arbitrary SQL command execution, potentially leading to full database compromise and possibly remote code execution depending on the database setup. The vulnerability is fixed in version 4.0.14.