Threats tagged 'ghsa-q9rr-6m77-6xg8'

phpMyAdmin versions through 5.2.3 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped col_extra and col_attribute parameters in the /database/central-columns endpoint. This injection affects INSERT and UPDATE queries on the pma__central_columns table executed with controluser privileges, potentially enabling attackers to read or modify other users' configuration-storage data.