{"id":"CVE-2026-119427","kind":"vulnerability","aliases":["CVE-2026-119427"],"related":[],"title":"phpMyAdmin: Designer settings save lets logged-in users inject SQL","description":"phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.","summary":"phpMyAdmin through 5.2.3 fails to escape JSON output in the Designer saveSetting() function, so SQL can be injected through the index or value parameters. An authenticated user can overwrite other users' Designer settings or run queries against the controluser database.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mariadb","mysql","package","phpmyadmin","self-hosted"],"not_affected_if":["auth-required","phpmyadmin-newer-than-5.2.3"],"how_to_check":"- Check the installed phpMyAdmin version (for example `phpMyAdmin --version` or the version shown in the footer) and see whether it is `5.2.3` or older\n- Confirm whether the Designer feature is reachable by users, by looking for requests to `/database/designer` with `operation=save_setting_value` in the web server access logs","fix":"- Move phpMyAdmin to a version newer than `5.2.3`; the sources do not name the fixed release","status":"open","published_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:34:08+00:00","updated_at":"2026-10-30T12:34:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move phpMyAdmin to a version newer than `5.2.3`; the sources do not name the fixed release","reach":"internet","title":"phpMyAdmin: Designer settings save lets logged-in users inject SQL","impact":"medium","summary":"phpMyAdmin through 5.2.3 fails to escape JSON output in the Designer saveSetting() function, so SQL can be injected through the index or value parameters. An authenticated user can overwrite other users' Designer settings or run queries against the controluser database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["phpmyadmin","mysql","mariadb","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in users read or overwrite other users' settings and query the control database","analyst_note":"Find the fixed phpMyAdmin version and the vendor advisory; the NVD entry alone does not name a fix.","how_to_check":"- Check the installed phpMyAdmin version (for example `phpMyAdmin --version` or the version shown in the footer) and see whether it is `5.2.3` or older\n- Confirm whether the Designer feature is reachable by users, by looking for requests to `/database/designer` with `operation=save_setting_value` in the web server access logs","plain_action":"","needs_analyst":true,"not_affected_if":["phpmyadmin-newer-than-5.2.3","auth-required"],"who_is_affected":"Any server running phpMyAdmin 5.2.3 or older where users have logins to the web interface. The flaw needs an authenticated account, so exposure is lower where phpMyAdmin is limited to administrators or behind extra access control. Teams that run phpMyAdmin only on a private network with trusted users face less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4151,"output_tokens":654,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119427':14A,17A '-2026':13A,16A '/database/designer':102C '5.2.3':27B,67C 'allow':77C 'attack':88C 'authent':50B,78C 'contain':68C 'controlus':63B,111C 'craft':91C 'cve':12A,15A 'databas':64B 'design':2A,35B,56B,74C,107C 'encod':86C 'escap':30B 'fail':28B 'function':37B 'host':24B 'index':45B,92C 'inject':10A,42B,71C,81C 'json':31B,85C 'let':5A 'log':7A 'logged-in':6A 'mariadb':18B 'mysql':19B 'oper':97C 'output':32B,87C 'overwrit':53B,104C 'packag':20B 'paramet':48B,95C 'phpmyadmin':1A,21B,25B,65C 'queri':60B 'run':59B,110C 'save':4A,98C 'saveset':36B,75C 'self':23B 'self-host':22B 'send':90C 'set':3A,57B,99C,108C 'sql':11A,39B,70C,82C 'subqueri':112C 'unescap':84C 'user':9A,51B,55B,79C,106C 'valu':47B,94C,100C 'via':83C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Any server running phpMyAdmin 5.2.3 or older where users have logins to the web interface. The flaw needs an authenticated account, so exposure is lower where phpMyAdmin is limited to administrators or behind extra access control. Teams that run phpMyAdmin only on a private network with trusted users face less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119427","severity":null,"published_at":"2026-10-30T12:16:39+00:00","modified_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}