CVE-2026-119426— phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

Quick assessment

Affected

phpMyAdmin phpMyAdmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyAdmin 5.2.3 及更早版本存在跨站请求伪造（CSRF）漏洞。该漏洞允许远程攻击者绕过非 AJAX POST 请求中的 CSRF 令牌检查，从而执行任意 SQL 语句。攻击者可诱骗已认证的用户提交携带参数的跨站 POST 请求，目标路径为或，进而在 HTTP 认证或配置文件认证模式下，以受害者的数据库权限执行 SQL 操作。

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
phpMyAdmin	phpMyAdmin	0 ~ 5.2.3	-

II. Public POCs for CVE-2026-119426

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119426

请登录查看更多情报信息。

Other References for CVE-2026-119426 (7)

https://abraxaslabs.tech/research/phpmyadmin-csrf-sql third-party-advisory
https://github.com/phpmyadmin/phpmyadmin product
https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789 patch
https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef patch
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151 technical-description
https://github.com/phpmyadmin/phpmyadmin/pull/20569 patch issue-tracking
https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119426

Same Patch Batch · phpMyAdmin · 2026-10-30 · 7 CVEs total

CVE-2026-119561	6.8 MEDIUM	phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
CVE-2026-119563	5.4 MEDIUM	phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
CVE-2026-119429	4.3 MEDIUM	phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
CVE-2026-119427	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
CVE-2026-119562	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428	3.7 LOW	phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

IV. Related Vulnerabilities

Same product: phpMyAdmin

Same vendor: phpMyAdmin

Same weakness: CWE-352