{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/phpmyadmin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119426"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["phpMyAdmin (\u003c= 5.2.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["phpMyAdmin"],"content_html":"\u003cp\u003ephpMyAdmin versions through 5.2.3 are vulnerable to a cross-site request forgery (CSRF) flaw that stems from the improper validation of CSRF tokens during non-AJAX POST requests. When using http or config authentication, an attacker can craft a malicious cross-site POST request targeting the /sql or /database/sql endpoints. If an authenticated user interacts with this request, the attacker can execute arbitrary SQL commands with the victim's database privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary SQL commands on the database server using the privileges of the victimized user. This could lead to unauthorized data exposure, modification, or deletion, depending on the victim's database permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade phpMyAdmin to a patched version beyond 5.2.3 as soon as one is released.\u003c/li\u003e\n\u003cli\u003eImplement strict SameSite cookie attributes (e.g., SameSite=Strict or SameSite=Lax) on the web server hosting phpMyAdmin to mitigate CSRF risks.\u003c/li\u003e\n\u003cli\u003eAdvise administrators and users to avoid browsing untrusted websites while authenticated to sensitive database administration interfaces.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for suspicious POST requests to /sql or /database/sql originating from unexpected Referer or Origin headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T13:29:37Z","date_published":"2026-10-30T13:29:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phpmyadmin-csrf/","summary":"phpMyAdmin versions up to 5.2.3 are susceptible to a CSRF vulnerability allowing remote attackers to execute arbitrary SQL queries by tricking authenticated users into submitting malicious non-AJAX POST requests.","title":"phpMyAdmin: Cross-Site Request Forgery via non-AJAX POST (CVE-2026-119426)","url":"https://feed.craftedsignal.io/briefs/2026-10-phpmyadmin-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpMyAdmin","version":"https://jsonfeed.org/version/1.1"}