phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure. This issue has been patched in version 4.1.1.

Affected: Packagist: thorsten/phpmyfaq

### Summary

The `searchCustomPages()` method in `phpmyfaq/src/phpMyFAQ/Search.php` uses `real_escape_string()` (via `escape()`) to sanitize the search term before embedding it in LIKE clauses. However, `real_escape_string()` does **not** escape SQL LIKE metacharacters `%` (match any sequence) and `_` (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure.

### Details

**File:** `phpmyfaq/src/phpMyFAQ/Search.php`, lines 226–240

**Vulnerable code:** ```php $escapedSearchTerm = $this->configuration->getDb()->escape($searchTerm); $searchWords = explode(' ', $escapedSearchTerm); $searchConditions = [];

foreach ($searchWords as $word) { if (strlen($word) <= 2) { continue; } $searchConditions[] = sprintf( "(page_title LIKE '%%%s%%' OR content LIKE '%%%s%%')", $word, $word ); } ```

`escape()` calls `mysqli::real_escape_string()`, which escapes characters like `'`, `\`, `NULL`, etc. — but explicitly does **not** escape `%` or `_`, as these are not SQL string delimiters. They are, however, LIKE pattern wildcards.

**Attack vector:**

A user submits a search term containing `_` or `%` as part of a 3+ character word (to bypass the `strlen <= 2` filter). Examples:

- Search for `a_b` → LIKE becomes `'%a_b%'` → `_` matches any single character, e.g. matche…