UBUNTU-CVE-2026-119426: CSRF
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of phpMyAdmin through 5.2.3 using HTTP or config authentication are exposed when a victim is authenticated to phpMyAdmin and can be induced to submit a malicious cross-site POST request.
What does an attacker need to exploit it?
The attacker does not need prior privileges, but must lure an authenticated victim into interacting with a crafted request. Exploitation targets non-AJAX POST requests containing sql_query sent to /sql or /database/sql.
What is the impact if exploitation succeeds?
The attacker can execute arbitrary SQL using the authenticated victim's database privileges. The resulting impact depends on the privileges assigned to that victim's database account.