CVE-2026-119426
Received Received - Intake

phpMyAdmin CSRF Bypass Leads to SQL Injection

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119426
EUVD
EUVD-2026-113806

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpMyAdmin phpMyAdmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyAdmin through version 5.2.3 has a cross-site request forgery (CSRF) vulnerability. It allows remote attackers to execute arbitrary SQL commands by bypassing CSRF token checks on non-AJAX POST requests. Attackers can trick authenticated users into submitting malicious POST requests to /sql or /database/sql endpoints, which then run SQL queries with the victim's database privileges under HTTP or config authentication.

Detection Guidance

Detecting this vulnerability requires checking for outdated phpMyAdmin versions. Run: phpMyAdmin --version or check the web interface footer. Inspect server logs for POST requests to /sql or /database/sql with sql_query parameters from unexpected sources.

Impact Analysis

This vulnerability can allow attackers to execute unauthorized SQL commands on your database if you are using phpMyAdmin through 5.2.3. This could lead to data theft, data manipulation, or complete database compromise. Attackers might delete, modify, or exfiltrate sensitive information without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to unpatched software.

Mitigation Strategies

Upgrade phpMyAdmin to version 5.2.4 or later immediately. Disable non-AJAX POST requests if possible. Implement strict CSRF token validation and monitor for suspicious SQL queries in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart