GitHub Security Advisory: GHSA-fxm2-cmwj-qvx4
Package: phpmyfaq/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 4.0.13
Patched in: 4.0.14

Summary: phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

Details:
### Summary

An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ (v4.0.13 and prior) allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration.

### Details

The vulnerability exists in the `save` method within the `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php` controller. This method handles the saving of application-wide configuration settings. It retrieves all submitted form data as an associative array via `$request->get('edit')`.

The core of the issue is that while the *values* of this array are processed, the *keys* are trusted implicitly and are not sanitized or validated.

**File:** `src/phpMyFAQ/Controller/Administration/ConfigurationTabController.php`
```php
// ...
public function save(Request $request): JsonResponse
{
    $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);

    $configurationData = $request->get('edit');
    // ...
    
    foreach ($configurationData as $key => $value) {
        // The key from the user input is used to build the $newConfigValues array.
        $newConfigValues[$key] = (string) $value;
        // ...
    }

    // ...
    // The array, containing user-controlled keys, is passed to the model.
    $this->configuration->update($newConfigValues);

    return $this->json(['success' => Translation::get('ad_config_saved')], Response::HTTP_OK);
}
```

The `$newConfigValues` array, which contains user-controlled keys, is then passed to the `update` method in the `src/phpMyFAQ/Configuration.php` model. Here, the key (`$name`) is directly concatenated into a raw SQL query string.

**File:** `src/phpMyFAQ/Configuration.php`
```php
public function update(array $newConfigs): bool
{
    // ...
    foreach ($newConfigs as $name => $value) {
        if ($name != 'main.phpMyFAQToken' && !in_array($name, $runtimeConfigs)) {
            // VULNERABLE CODE: The array key '$name' is not escaped and is directly
            // concatenated into the SQL query string. The value is escaped, but not the name.
            $update = sprintf(
                "UPDATE %s%s SET config_value = '%s' WHERE config_name = '%s'",
                Database::getTablePrefix(),
                $this->tableName,
                $this->getDb()->escape(trim($value)),
                $name
            );

            $this->getDb()->query($update);
            // ...
        }
    }

    return true;
}
```
An attacker can craft a malicious form parameter name (which becomes the array key) to break out of the single quotes in the `WHERE` clause and inject arbitrary SQL commands.

### PoC (Proof of Concept)

**Prerequisites:**
1.  A running instance of phpMyFAQ (v4.0.13 confirmed vulnerable).
2.  An authenticated user sessi