phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.3 · phpmyadminNVD modified 2026-10-30 11:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/CentralColumns.php#L268 technical-description
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/CentralColumns.php#L637-L638 technical-description
- https://abraxaslabs.tech/research/phpmyadmin-pmadb-central-sqli third-party-advisory
- https://github.com/phpmyadmin/phpmyadmin product
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-central-columns-col-extra-and-col-attribute third-party-advisory