The vulnerability allows remote attackers to bypass the CSRF token check on non‑AJAX POST requests to the /sql endpoint in phpMyAdmin, enabling the execution of arbitrary SQL statements under the victim’s database privileges. This flaw effectively permits attackers to read, modify, or delete data in databases accessed by the authenticated user, potentially leading to data compromise, privacy violations, or further lateral movement. The weakness is classified as a CSRF (Common Weakness Enumeration 352) vulnerability.

The flaw affects all releases of phpMyAdmin up to and including version 5.2.3. Administrators using phpMyAdmin 5.2.3 or earlier should review installed versions and plan an upgrade. The affected product is the phpMyAdmin web interface, which may be deployed in various client‑side or server‑side configurations.

The CVSS score of 7.7 indicates high severity, and although the EPSS score is not available, the lack of a KEV listing suggests no widespread public exploitation yet. The attack requires a victim to be authenticated and to perform a non‑AJAX POST to /sql or /database/sql, typically by tricking them through a crafted link or form. Once the attacker supplies the sql_query parameter, any valid SQL can be executed with the victim’s privileges, allowing a wide range of attacks from data exfiltration to privilege escalation.