phpMyAdmin through version 5.2.3 contains a SQL injection flaw that allows an authenticated user to inject arbitrary SQL by supplying unescaped values in the col_extra and col_attribute fields of the Central Columns interface. The payload is embedded into pma__central_columns INSERT and UPDATE queries that run under the controluser account, enabling the attacker to read or modify configuration-store data belonging to other users.

All installations of phpMyAdmin up to and including version 5.2.3 are affected, regardless of the underlying operating system. The vulnerability applies specifically to the Central Columns feature which processes the col_extra and col_attribute parameters.

The CVSS base score of 2.3 indicates a low overall severity, and the EPSS score is not available, suggesting limited evidence of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must be authenticated with controluser privileges to exploit it. If successful, the attacker can alter other users’ configuration data but does not gain broader database or system compromise. The vulnerable code path is confined to the Central Columns interface, which reduces the overall attack surface.