CVE-2026-119562 in phpMyAdmin
Summary
by MITRE • 10/30/2026
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in phpMyAdmin versions through 5.2.3 represents a critical authenticated SQL injection flaw located within the central columns management interface. This specific weakness is triggered when an attacker interacts with the /database/central-columns endpoint, specifically by manipulating the col_extra and col_attribute parameters. Unlike many remote code execution or unauthenticated vulnerabilities that pose immediate threats to system integrity from outside the network perimeter, this vulnerability requires valid authentication credentials. However, because phpMyAdmin serves as a primary interface for database administration in countless web applications, obtaining these credentials is often feasible through credential stuffing, phishing, or other common attack vectors. The core technical flaw lies in the insufficient sanitization and validation of user-supplied input before it is incorporated into SQL statements. Specifically, when creating or updating central column definitions, the application fails to properly escape special characters within the col_extra and col_attribute fields, allowing an attacker to inject arbitrary SQL commands directly into the database queries executed by the controluser account.
The operational impact of this vulnerability extends beyond simple data exfiltration due to the elevated privileges associated with the pma__central_columns table operations. The INSERT and UPDATE queries affected by this flaw are executed using the controluser, which typically holds administrative or high-level permissions within phpMyAdmin's configuration storage schema. This privilege level allows an attacker not only to read sensitive information but also to modify existing records. By injecting SQL into these specific statements, a malicious actor can alter other users' configuration-storage data stored in the pma__central_columns table. This capability enables attackers to manipulate how phpMyAdmin displays or manages database structures for legitimate users, potentially leading to denial of service through corrupted metadata or facilitating further attacks by altering session behaviors and access controls defined within the application's internal state management systems.
From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific context involves authenticated users exploiting input validation failures to manipulate backend database operations. In terms of tactical mapping under the MITRE ATT&CK framework, this activity falls under T1059, Command and Scripting Interpreter, specifically when considering how injected SQL can be used to execute commands within the database environment. Furthermore, it relates to T1136, Create Account, if an attacker uses the injection to create new administrative entries in phpMyAdmin's internal tables, or more accurately T1078, Valid Accounts, as the attack relies on pre-existing legitimate credentials combined with a logic flaw that escalates their impact. The exploitation of this vulnerability allows for unauthorized data access and modification, violating the confidentiality and integrity principles essential to secure database administration tools.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective mitigation is to upgrade phpMyAdmin to version 5.2.4 or later, where developers have implemented proper input validation and parameterized queries for the affected endpoints. For organizations unable to patch immediately due to operational constraints, implementing a Web Application Firewall with rules specifically targeting SQL injection patterns in POST requests directed at /database/central-columns can provide temporary protection. Additionally, enforcing strict least-privilege principles on database accounts is crucial; ensuring that phpMyAdmin's controluser does not possess unnecessary administrative privileges over the entire database schema limits the blast radius of such an injection. Regular auditing of authentication logs for unusual activity patterns and restricting access to phpMyAdmin via IP whitelisting or multi-factor authentication further reduces the likelihood of credential compromise, thereby mitigating the initial attack vector required to exploit this vulnerability.