UBUNTU-CVE-2026-119427: SQL Injection
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped jsonencode() output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated phpMyAdmin account with access to the Designer endpoint. The attack requires sending crafted index or value parameters in a request using operation=save_setting_value.
Is this exploitable without authentication?
No. The available information identifies the issue as requiring low privileges, and describes exploitation by authenticated users.
What could an attacker do through this vulnerability?
A successful attack can overwrite other users' Designer settings or execute subqueries using the phpMyAdmin controluser context. The stated impact is limited confidentiality and integrity impact, with no availability impact.