phpMyAdmin EUVD-2026-113807

Requires an authenticated phpMyAdmin account (CVSS PR:L) with access to the Designer feature, and the phpMyAdmin configuration storage (controluser / pmadb control database and the designer_settings control table) must be configured and enabled, since saveSetting() writes to control tables over the control connection. Exploitation targets the index/value parameters of operation=save_setting_value on /database/designer. Limiting factors: authentication is mandatory, the configuration storage must be set up (not phpMyAdmin's minimal default), and the CVSS AC:H/AT:P rating reflects that the trigger is constrained - the injected data flows through json_encode() output, which escapes quotes and limits freely injectable characters, so the attack is not a straightforward quote break-out. Impact is confined to control-database tables (other users' Designer settings / controluser subqueries), not the user's own data or the host.

This is a low-priority, high-barrier issue rather than an urgent threat. The supplied CVSS 4.0 base score is 2.3 (Low) with vector AV:N/AC:H/AT:P/PR:L/UI:N and only Low vulnerable-system confidentiality and integrity impact (VC:L/VI:L), with no availability or subsequent-system impact. The combination of AC:H, AT:P and PR:L means exploitation is network-reachable but requires an authenticated low-privilege phpMyAdmin account plus a non-trivial, partly attacker-uncontrolled trigger condition. The vuln.today Decision label is 'monitor', which aligns with the low score. No CISA KEV listing and no EPSS score were provided, so there is no signal of active or probable exploitation; the only exploitation-related artifact is a public research write-up (abraxaslabs.tech) and a VulnCheck advisory, which document the flaw but are not confirmed as working weaponized exploit code. A vendor patch is available (phpMyAdmin PR #18698 and associated commits). Net: a genuine authenticated SQL-injection in the Designer feature, but with constrained impact (control tables / other users' designer settings via the controluser) and a high exploitation barrier - treat as a scheduled-patch item, not an emergency.

An authenticated phpMyAdmin user with access to the Designer feature sends a crafted request to /database/designer with operation=save_setting_value, placing SQL into the index or value parameter. Because the value is passed through json_encode() output that is not properly escaped before being concatenated into a control-connection query, the attacker can break out of the intended statement to overwrite other users' saved Designer settings or run subqueries as the controluser. A public research write-up describing the technique exists, but it is not verified as working exploit code, and the AC:H/AT:P rating indicates the trigger is not trivially reliable.