phpMyAdmin: Cross-Site Request Forgery via non-AJAX POST (CVE-2026-119426)

phpMyAdmin versions through 5.2.3 are vulnerable to a cross-site request forgery (CSRF) flaw that stems from the improper validation of CSRF tokens during non-AJAX POST requests. When using http or config authentication, an attacker can craft a malicious cross-site POST request targeting the /sql or /database/sql endpoints. If an authenticated user interacts with this request, the attacker can execute arbitrary SQL commands with the victim's database privileges.

Impact

Successful exploitation allows for the execution of arbitrary SQL commands on the database server using the privileges of the victimized user. This could lead to unauthorized data exposure, modification, or deletion, depending on the victim's database permissions.

Recommendation

• Upgrade phpMyAdmin to a patched version beyond 5.2.3 as soon as one is released.
• Implement strict SameSite cookie attributes (e.g., SameSite=Strict or SameSite=Lax) on the web server hosting phpMyAdmin to mitigate CSRF risks.
• Advise administrators and users to avoid browsing untrusted websites while authenticated to sensitive database administration interfaces.
• Monitor web access logs for suspicious POST requests to /sql or /database/sql originating from unexpected Referer or Origin headers.