CVE-2026-119426 in phpMyAdmin
Summary
by MITRE • 10/30/2026
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in phpMyAdmin versions through 5.2.3 represents a critical failure in access control mechanisms, specifically manifesting as a Cross-Site Request Forgery flaw that enables unauthorized execution of arbitrary Structured Query Language commands. This issue stems from an insufficient validation process regarding the integrity and origin of incoming HTTP POST requests within specific administrative endpoints. While phpMyAdmin implements CSRF protection tokens to mitigate such attacks for AJAX-based interactions, this security control is not consistently applied across all request types. Specifically, non-AJAX POST requests directed at the /sql or /database/sql paths do not undergo rigorous token verification before processing user-supplied input. This architectural inconsistency creates a significant gap in the application's defense-in-depth strategy, allowing malicious actors to exploit authenticated sessions without requiring additional authentication factors beyond the existing session cookie.
From a technical perspective, the core flaw lies in the server-side logic that handles SQL query submissions. When an attacker crafts a malicious web page containing a form or script designed to automatically submit a POST request to the vulnerable phpMyAdmin endpoints, they can inject arbitrary sql_query parameters into the payload. Because the target application does not validate the CSRF token for these specific non-AJAX requests, it treats the forged submission as legitimate and originating from an authenticated user's browser session. Consequently, when a victim who is currently logged into their phpMyAdmin instance visits the attacker-controlled page or clicks on a malicious link, their browser automatically includes their authentication cookies with the request. The server then executes the injected SQL commands using the privileges associated with that victim’s database account, effectively bypassing intended security boundaries.
The operational impact of this vulnerability is severe due to its potential for data exfiltration, modification, or destruction within the connected MySQL or MariaDB databases. Since the executed queries run under the context of the authenticated user, an attacker can leverage these elevated privileges to dump sensitive tables, alter configuration settings, create new administrative users, or even execute system-level commands if database permissions allow it via functions like INTO OUTFILE or LOAD_FILE. This capability transforms a simple web-based vulnerability into a potential full compromise of the underlying data infrastructure. The risk is particularly acute in environments where phpMyAdmin is used for managing multiple databases with varying levels of privilege, as an attacker could escalate their access by manipulating database structures to grant themselves higher-level permissions over time.
This flaw aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF), and specifically highlights the failure to verify that a request originates from a trusted source for state-changing operations. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques related to Collection via Client-side Payload Injection or potentially Command and Control if used to exfiltrate data back to an external server. The attack vector relies heavily on social engineering elements, requiring the victim to be authenticated and interact with a malicious site, which classifies it under tactics involving user interaction and browser-based exploitation.
To mitigate this vulnerability, administrators must immediately upgrade phpMyAdmin to version 5.2.4 or later, where the CSRF token validation has been extended to cover all POST requests regardless of whether they are AJAX-driven or not. In scenarios where upgrading is not immediately feasible, temporary mitigations include restricting access to phpMyAdmin through IP whitelisting using web server configurations such as Apache’s mod_authz_host or Nginx allow directives. Additionally, enabling HTTP Strict Transport Security and ensuring that the application runs exclusively over HTTPS can reduce the risk of session hijacking which often accompanies CSRF attacks. It is also advisable to review database user privileges within phpMyAdmin to ensure that administrative accounts do not possess excessive permissions beyond what is strictly necessary for their operational role, thereby limiting the blast radius should a successful exploitation occur.