CVE-2009-1151

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x...

9.8 CriticalIn KEVPublic exploitFix available

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

96.6%Up 10.1 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2009-1151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2009-1151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2009-1151 9.8

Record: EUVD-2009-1151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fw5c-3235-cprv 9.8

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x...

Record: GHSA-fw5c-3235-cprv
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

CISA KEV No score

phpMyAdmin Remote Code Execution Vulnerability

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

Record: CVE-2009-1151
Weakness: CWE-94
Updated: 2026-11-02

OSV 9.8

Record: CVE-2009-1151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-1151 9.8

Record: DEBIAN-CVE-2009-1151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`phpmyadmin` Debian:12	before 4:3.1.3.1-1	4:3.1.3.1-1
`phpmyadmin` Debian:13	before 4:3.1.3.1-1	4:3.1.3.1-1
`phpmyadmin` Debian:14	before 4:3.1.3.1-1	4:3.1.3.1-1
`phpmyadmin` Debian:4.0 From an advisory covering 2 CVEs	before 4:2.9.1.1-11, plus listed versions 4:2.9.1.1-104:2.9.1.1-34:2.9.1.1-44:2.9.1.1-54:2.9.1.1-64:2.9.1.1-74:2.9.1.1-84:2.9.1.1-9	4:2.9.1.1-11
`phpmyadmin` Debian:5.0 From an advisory covering 2 CVEs	before 4:2.11.8.1-5+lenny1, plus listed versions 4:2.11.8.1-5	4:2.11.8.1-5+lenny1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	phpMyAdmin Config File Code Injection	2009-03-24
Exploit-DB	phpMyAdmin - '/scripts/setup.php' PHP Code Injection	2009-06-09
Exploit-DB	phpMyAdmin - 'pmaPWN!' Code Injection / Remote Code Execution	2009-06-22
Exploit-DB	phpMyAdmin - Config File Code Injection (Metasploit)	2010-07-03
PoC in GitHub	pagvac/pocs	2018-02-03
PoC in GitHub	e-Thug/PhpMyAdmin	2023-06-24
PoC in GitHub	tpdlshdmlrkfmcla/ZmEu	2025-03-30
Nuclei	PhpMyAdmin Scripts - Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1151 is a critical vulnerability (CVSS 9.8) in Phpmyadmin, published March 26, 2009. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.6%, the 99th percentile. Fixed in phpmyadmin 4:3.1.3.1-1.

References

Show 13 moreShow less