An authenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.6 permits high-privileged attackers to execute arbitrary database commands, risking full data compromise.

The application fails to properly sanitize user-supplied input in the StopWords::add method before incorporating it into a SQL statement. An authenticated administrator can exploit this flaw to perform unauthorized database operations, including data exfiltration or table deletion.

The vulnerability carries a CVSS score of 8.5, reflecting its high impact on data confidentiality and integrity. Successful exploitation allows an attacker with administrative access to manipulate the backend database, which may result in the loss of proprietary FAQ content, unauthorized modification of system settings, or a complete compromise of the application database.

Immediate Action: Update phpMyFAQ to version 4.1.6 or later to apply the necessary input sanitization and secure the StopWords::add method.

Proactive Monitoring: Review database query logs for anomalous activity, specifically looking for unusual patterns or SQL syntax errors originating from the stop-word management administrative interface.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the software can be patched.

Public Exploit Available: Unknown

Given the potential for severe database manipulation, administrators should prioritize the upgrade to version 4.1.6 immediately. Restricting access to the stop-word management interface to only trusted personnel can serve as a vital secondary measure until the update is deployed.