CVE-2026-119426: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

Published Oct 30, 2026

Updated

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Deployments using phpMyAdmin through 5.2.3 with HTTP or config authentication are exposed when an authenticated user can be lured into submitting a cross-site POST request. The SQL executes with that victim's database privileges.

What does an attacker need to exploit this issue?

The attacker does not need credentials, but needs to induce an authenticated victim to submit a crafted non-AJAX POST containing sql_query to /sql or /database/sql. Exploitation requires user interaction.

What is the impact if exploitation succeeds?

An attacker can cause arbitrary SQL to run using the authenticated victim's database permissions. This can affect the confidentiality, integrity, and availability of data accessible to that account.

CVE-2026-119426: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?