PhpMyAdmin (<= 5.2.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/phpmyadmin--5.2.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 13:29:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgphpMyAdmin: Cross-Site Request Forgery via non-AJAX POST (CVE-2026-119426)https://feed.craftedsignal.io/briefs/2026-10-phpmyadmin-csrf/Fri, 30 Oct 2026 13:29:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-phpmyadmin-csrf/phpMyAdmin versions up to 5.2.3 are susceptible to a CSRF vulnerability allowing remote attackers to execute arbitrary SQL queries by tricking authenticated users into submitting malicious non-AJAX POST requests.phpMyAdmin versions through 5.2.3 are vulnerable to a cross-site request forgery (CSRF) flaw that stems from the improper validation of CSRF tokens during non-AJAX POST requests. When using http or config authentication, an attacker can craft a malicious cross-site POST request targeting the /sql or /database/sql endpoints. If an authenticated user interacts with this request, the attacker can execute arbitrary SQL commands with the victim's database privileges.

Impact

Successful exploitation allows for the execution of arbitrary SQL commands on the database server using the privileges of the victimized user. This could lead to unauthorized data exposure, modification, or deletion, depending on the victim's database permissions.

Recommendation

  • Upgrade phpMyAdmin to a patched version beyond 5.2.3 as soon as one is released.
  • Implement strict SameSite cookie attributes (e.g., SameSite=Strict or SameSite=Lax) on the web server hosting phpMyAdmin to mitigate CSRF risks.
  • Advise administrators and users to avoid browsing untrusted websites while authenticated to sensitive database administration interfaces.
  • Monitor web access logs for suspicious POST requests to /sql or /database/sql originating from unexpected Referer or Origin headers.
]]>highadvisory