UBUNTU-CVE-2026-119562: SQL Injection
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs an authenticated phpMyAdmin account with low privileges. No user interaction is required, but exploitation has high attack complexity.
What can a successful attacker access or change?
The injection affects INSERT and UPDATE queries against pma__central_columns that execute with controluser privileges. This can allow reading or modifying other users' configuration-storage data.
Which releases are in scope?
phpMyAdmin versions through 5.2.3 are described as affected.