CVE-2009-1151
phpMyAdmin Remote Code Execution Vulnerability
Published Mar 26, 2009 · updated Jun 16, 2026 · phpmyadmin phpmyadmin
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2009 · Catalog
Detected
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe debian/debian linux4.0
- cpe debian/debian linux5.0
- cpe phpmyadmin/phpmyadminversion unspecified
- vendor phpMyAdmin phpMyAdminversion unspecified
Sources
- CISA KEVCVE-2009-1151
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
cisa.gov - CVE.orgCVE-2009-1151
Official CVE identifier
cve.org - FIRST EPSSCVE-2009-1151
30-day exploitation probability 96.6%
first.org - Exploit Database16913
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database8921
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database8992
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_unix/webapp/phpmyadmin_config
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2009-1151
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
nvd.nist.gov