phpMyAdmin versions up through 5.2.3 contain a server‑side request forgery flaw in setup/validate.php. The script accepts user‑supplied host and port values and forwards them to the Validator::testDBConnection() routine, which attempts a MySQL‑protocol connection. This allows an unauthenticated attacker to trigger outbound connections from the web server, potentially probing internal network services and leaking error messages that reveal internal architecture. The weakness is classified as CWE‑918, reflecting a lack of proper validation of external requests.

All installations of phpMyAdmin that expose the setup/validate.php endpoint after the setup process has been completed or disabled are vulnerable. This includes every vendor distribution of phpMyAdmin up to and including release 5.2.3, regardless of operating system, as the vulnerability resides in the PHP code rather than the underlying host.

The CVSS score of 6.3 indicates a medium‑severity risk. The EPSS score is not available at this time, but the flaw is exploitable without authentication and can be leveraged to enumerate services behind the web server. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed live exploitation yet, yet the absence of a KEV listing does not diminish the potential impact. Attackers can send unauthenticated HTTP POST requests to setup/validate.php, supply arbitrary host and port data, and cause the server to initiate outbound MySQL connections, which may reveal internal network configurations or services.