CVE-2026-119427
Received Received - Intake

phpMyAdmin SQL Injection in Designer saveSetting()

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119427
EUVD
EUVD-2026-113807

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpMyAdmin phpMyAdmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL injection vulnerability in phpMyAdmin versions up to 5.2.3. It exists in the Designer saveSetting() function where unescaped json_encode() output allows authenticated users to inject malicious SQL code. Attackers can manipulate index or value parameters with operation=save_setting_value in the /database/designer endpoint to overwrite other users' designer settings or execute controluser subqueries.

Detection Guidance

To detect this vulnerability, monitor phpMyAdmin access logs for POST requests to /database/designer with parameters operation=save_setting_value. Look for crafted index or value parameters containing SQL-like syntax or unusual JSON payloads.

Impact Analysis

If you use phpMyAdmin 5.2.3 or earlier, an authenticated attacker could potentially modify your database settings, access sensitive data, or execute unauthorized database queries. This could lead to data breaches, unauthorized data manipulation, or system compromise depending on the database permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (data protection), HIPAA (health information), or other regulations. Organizations using vulnerable phpMyAdmin versions may face compliance violations if data is exposed or altered due to this flaw.

Mitigation Strategies

Immediately update phpMyAdmin to the latest version beyond 5.2.3. Restrict access to the /database/designer endpoint via web server configuration. Review and sanitize all user inputs in phpMyAdmin configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart