peter bassill · operator
$ cve CVE-2009-1151 JSON

CVE-2009-1151 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 96.6% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS96.57% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-94
On CISA KEVyes — remediate by 2022-04-15
Public exploityes
Published2009-03-26
Last modified2026-06-16

CISA KEV

NamephpMyAdmin Remote Code Execution Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productphpMyAdmin / phpMyAdmin
Ransomware usenone reported

Affected (2)

VendorProduct
debiandebian linux
phpmyadminphpmyadmin

Public exploits

SourceTitleDate
exploit-dbphpMyAdmin - Config File Code Injection (Metasploit)2010-07-03
exploit-dbphpMyAdmin - 'pmaPWN!' Code Injection / Remote Code Execution2009-06-22
exploit-dbphpMyAdmin - '/scripts/setup.php' PHP Code Injection2009-06-09

References

→ the Explorer  ·  watch your stack  ·  NVD