Vulnerability details

CVE-2009-1151

Actively exploited

phpMyAdmin phpMyAdmin

CVSS 3.1

9.8Critical

Official description

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php x_refsource_CONFIRM
http://security.gentoo.org/glsa/glsa-200906-03.xml vendor-advisoryx_refsource_GENTOO
http://secunia.com/advisories/34642 third-party-advisoryx_refsource_SECUNIA
http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/ x_refsource_MISC
http://www.securityfocus.com/archive/1/504191/100/0/threaded mailing-listx_refsource_BUGTRAQ
http://www.debian.org/security/2009/dsa-1824 vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html vendor-advisoryx_refsource_SUSE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:115 vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/34236 vdb-entryx_refsource_BID
http://secunia.com/advisories/34430 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/35635 third-party-advisoryx_refsource_SECUNIA
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301 x_refsource_CONFIRM
https://www.exploit-db.com/exploits/8921 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/35585 third-party-advisoryx_refsource_SECUNIA
http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/ x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1151 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2009-03-26
Last updated: 2025-10-22
State: Published
Assigner (CNA): mitre
Kolun priority: 90 · Critical

CISA KEV catalog

Date added: 2022-03-25
Due date: 2022-04-15
Used in ransomware: Unknown

Exploit prediction (EPSS)

96.56%

Probability of exploitation in 30 days

99.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')