CVE-2026-119427
4.2 MEDIUMpublic exploit availablePublished 2026-10-30 · Updated 2026-10-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-89
Public exploit & PoC references
- https://github.com/phpmyadmin/phpmyadmin
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808
- https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65
- https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3
- https://github.com/phpmyadmin/phpmyadmin/pull/18698
All references
- https://abraxaslabs.tech/research/phpmyadmin-designer-json-sqli
- https://github.com/phpmyadmin/phpmyadmin
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808
- https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65
- https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3
- https://github.com/phpmyadmin/phpmyadmin/pull/18698
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesetting
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2015-20122
- HIGHCVE-2015-20128PoC
- HIGHCVE-2019-25776PoC
- HIGHCVE-2019-25778PoC
- HIGHCVE-2021-48008
- HIGHCVE-2022-4997
- HIGHCVE-2022-51021PoC
- HIGHCVE-2022-51023PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.