CVE-2009-1151
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- phpMyAdmin Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 97% (percentile: 100) as of 1 November 2026
- CWE
- CWE-94
Affected products
phpmyadmin: phpmyadmin; debian: debian linux
References
- http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/p… Vendor Advisory
- http://secunia.com/advisories/34430 Broken LinkVendor Advisory
- http://secunia.com/advisories/34642 Broken LinkVendor Advisory
- http://secunia.com/advisories/35585 Broken LinkVendor Advisory
- http://secunia.com/advisories/35635 Broken LinkVendor Advisory
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php PatchVendor Advisory
- http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/p… Vendor Advisory
- http://secunia.com/advisories/34430 Broken LinkVendor Advisory
- http://secunia.com/advisories/34642 Broken LinkVendor Advisory
- http://secunia.com/advisories/35585 Broken LinkVendor Advisory