phpMyAdmin EUVD-2026-113827

Requires an authenticated phpMyAdmin account (PR:L) AND a deployment where phpMyAdmin's configuration storage (pmadb) is set up with the pma__central_columns table and the Central Columns feature in use - this is not part of every phpMyAdmin install, which is a meaningful limiting factor. The concrete trigger is supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint, which are concatenated into pma__central_columns INSERT and UPDATE statements executed with controluser privileges. Limiting factors: valid authentication is mandatory, the configuration-storage feature must be enabled (non-default for many basic installs), the CVSS AC:H/AT:P indicates additional preconditions beyond a trivial request, and impact is confined to configuration-storage data of other phpMyAdmin users rather than arbitrary target databases.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 base score is 2.3 (Low), and the vector tells a consistent story: AV:N (network) but AC:H and AT:P (elevated complexity plus a specific attack requirement), PR:L (a valid authenticated phpMyAdmin account is required), and only Low confidentiality/integrity impact (VC:L/VI:L) with no availability or subsequent-system impact. The vuln.today decision label is 'monitor', which aligns with the low score. No EPSS score was provided in the input, and there is no CISA KEV listing, so exploitation status is 'no public exploit identified at time of analysis' in the strict sense - however, the input includes a VulnCheck advisory and an abraxaslabs.tech research write-up, so a public PoC/research reference exists; it is not verified as working exploit code. The signals do not conflict: a low-impact, privilege-required, high-complexity SQL injection confined to phpMyAdmin's configuration-storage tables is a real but minor finding, not an emergency. The ceiling on impact is important - injection occurs within pma__central_columns INSERT/UPDATE statements executed as the controluser, so the realistic worst case is reading or tampering with other phpMyAdmin users' configuration-storage data, not full database compromise of arbitrary target databases.

An attacker who already holds a valid phpMyAdmin login, on an instance where the configuration storage (pmadb) and Central Columns feature are configured, submits crafted col_extra and col_attribute values to /database/central-columns. Because these values are not escaped, the attacker injects SQL into the pma__central_columns INSERT/UPDATE queries, which run with controluser privileges, allowing them to read or modify other users' configuration-storage entries. A public research PoC reference exists (abraxaslabs/VulnCheck) but is not verified as working exploit code.