CVE-2009-1151

🗓️ 26 Mar 2009 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 1081 Views🌐 WEB

Static code injection vulnerability in phpMyAdmin setup.ph

Reporter	Title	Published	Views	Family All 75
FreeBSD	phpmyadmin -- insufficient output sanitizing when generating configuration file	24 Mar 200900:00	–	freebsd
0day.today	phpMyAdmin (/scripts/setup.php) PHP Code Injection Exploit	9 Jun 200900:00	–	zdt
GithubExploit	Exploit for Code Injection in Phpmyadmin	3 Feb 201822:26	–	githubexploit
GithubExploit	Exploit for Code Injection in Phpmyadmin	3 Feb 201822:26	–	githubexploit
Tenable Nessus	phpMyAdmin 2.11.x < 2.11.9.5 / 3.x < 3.1.3.1 RCE (PMASA-2009-3)	19 Apr 201900:00	–	nessus
Tenable Nessus	Debian DSA-1824-1 : phpmyadmin - several vulnerabilities	30 Jun 200900:00	–	nessus
Tenable Nessus	FreeBSD : phpmyadmin -- insufficient output sanitizing when generating configuration file (06f9174f-190f-11de-b2f0-001c2514716c)	25 Mar 200900:00	–	nessus
Tenable Nessus	GLSA-200906-03 : phpMyAdmin: Multiple vulnerabilities	30 Jun 200900:00	–	nessus
Tenable Nessus	phpMyAdmin setup.php save Action Arbitrary PHP Code Injection (PMASA-2009-3)	16 Apr 200900:00	–	nessus
Tenable Nessus	openSUSE Security Update : phpMyAdmin (phpMyAdmin-711)	21 Jul 200900:00	–	nessus

NVD

Node

phpmyadmin phpmyadminRange2.11.0–2.11.9.5

phpmyadmin phpmyadminRange3.0.0–3.1.3.1

Node

Source	Link
gnucitizen	www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/
debian	www.debian.org/security/2009/dsa-1824
secunia	www.secunia.com/advisories/35585
securityfocus	www.securityfocus.com/bid/34236
phpmyadmin	www.phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php
secunia	www.secunia.com/advisories/34430
security	www.security.gentoo.org/glsa/glsa-200906-03.xml
exploit-db	www.exploit-db.com/exploits/8921
securityfocus	www.securityfocus.com/archive/1/504191/100/0/threaded
labs	www.labs.neohapsis.com/2009/04/06/about-cve-2009-1151/

Parameter	Position	Path	Description	CWE
action	request body	/scripts/setup.php	PHP code injection via setup.php by delivering crafted configuration data that is unserialized and written to config.inc.php	CWE-94
configuration	request body	/scripts/setup.php	PHP code injection via setup.php by delivering crafted configuration data that is unserialized and written to config.inc.php	CWE-94

16 Jun 2026 23:06Current

7.5High risk

Vulners AI Score7.5

CVSS 27.5

CVSS 3.19.8

EPSS0.95438

SSVC