CVE-2026-119562
Received Received - Intake

Authenticated SQL Injection in phpMyAdmin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119562
EUVD
EUVD-2026-113827

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpMyAdmin phpMyAdmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in phpMyAdmin versions up to 5.2.3. Authenticated users can inject malicious SQL code by providing unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This allows attackers to manipulate INSERT and UPDATE queries in the pma__central_columns table, which runs with controluser privileges. The impact includes unauthorized reading or modification of other users' configuration-storage data.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized SQL injection attempts in phpMyAdmin's central columns feature. Monitor logs for suspicious queries targeting /database/central-columns with unescaped col_extra or col_attribute values. Use intrusion detection systems to flag unusual database access patterns.

Impact Analysis

If you use phpMyAdmin versions up to 5.2.3, an attacker with valid credentials could exploit this to access or alter sensitive database information. This may lead to data breaches, unauthorized changes to database structures, or exposure of confidential user data stored in phpMyAdmin's configuration tables.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation of this flaw may result in data breaches, triggering legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Immediately update phpMyAdmin to the latest version beyond 5.2.3. Restrict database user privileges to limit controluser access. Review and sanitize all user-supplied inputs in central columns configurations. Implement network-level monitoring for SQL injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart