An SQL Injection flaw exists in phpMyAdmin 5.2.3’s Designer saveSetting() method caused by unescaped json_encode() output. The weakness is a classic SQL Injection, categorized as CWE‑89. An authenticated user can send crafted index or value parameters with operation=save_setting_value to /database/designer and inject arbitrary SQL. This allows modification of other users’ designer settings or execution of controluser subqueries, potentially leading to unauthorized data manipulation or disclosure.

The vulnerability affects phpMyAdmin installations through version 5.2.3. All releases of phpMyAdmin up to and including 5.2.3 are affected.

The CVSS score of 2.3 indicates low severity, and no EPSS data is available, so the likelihood of exploitation is considered very low at this time. The vulnerability requires authenticated access to phpMyAdmin, meaning attackers must first obtain valid user credentials or otherwise authenticate to the web interface. Based on the description, it is inferred that the flaw allows arbitrary SQL execution only within an authenticated session and does not enable remote code execution or privilege escalation beyond the controluser context.