phpMyAdmin CVE-2026-119426

Requires an authenticated phpMyAdmin victim (through 5.2.3) whose instance uses http or config authentication, who is lured into submitting a cross-site non-AJAX POST carrying a sql_query parameter to /sql or /database/sql; the bypass relies specifically on the pre-patch middleware not rejecting non-AJAX POSTs with a missing/mismatched CSRF token. Limiting factors: victim user interaction is mandatory (UI:P - the admin must visit the attacker's page while logged in), the http/config authentication prerequisite is not the default cookie-auth deployment, and the resulting SQL impact is bounded by the victim account's database privileges.

This is a credible this_week-priority issue rather than an inflated high-CVSS artifact, but its real-world reach is gated by configuration. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) correctly captures a network-reachable CSRF (CWE-352) that needs victim interaction (UI:P) and carries an attack requirement (AT:P) - consistent with the description's statement that it works 'under http or config authentication,' which is not phpMyAdmin's default cookie-auth mode. Full confidentiality/integrity/availability impact on the database is justified because arbitrary SQL runs with the victim's privileges. VulnCheck reported it and vendor patch commits are confirmed, so the technical reality is well-established. However, EPSS is not provided in the input and the CVE is not listed in CISA KEV, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation; the SSVC/decision framework fields beyond the vuln.today 'this_week' label are not supplied. The AT:P attack requirement plus the dependency on a non-default authentication mode and an authenticated, interacting victim meaningfully lowers mass-exploitation likelihood compared to a pure AV:N/PR:N/UI:N flaw, so prioritize patching within the vendor's and decision label's timeframe rather than treating it as an active emergency.

An attacker hosts a web page containing an auto-submitting HTML form that POSTs a sql_query parameter to a target phpMyAdmin's /sql or /database/sql endpoint. When an administrator who is currently authenticated to that phpMyAdmin instance (under http or config authentication) is lured into visiting the page, the non-AJAX POST bypasses the CSRF token check and the injected SQL executes with the victim's full database privileges. A public PoC reference exists (abraxaslabs.tech research writeup and the VulnCheck advisory); it is not verified as working exploit code.