ZeroDay Findings
Sign inSign up

Findings

CVE-2009-1151

phpMyAdmin Remote Code Execution Vulnerability

Published Mar 26, 2009 · updated Jun 16, 2026 · n/a n/a

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2009 · Catalog

    Detected

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe debian/debian linux4.0
  • cpe debian/debian linux5.0
  • cpe phpmyadmin/phpmyadminversion unspecified
  • vendor n/a n/aversion unspecified
  • vendor phpMyAdmin phpMyAdminversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2009-1151

    Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2009-1151

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2009-1151

    30-day exploitation probability 96.6%

    first.org
  • Exploit DatabasePublic exploit reference16913

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference8921

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference8992

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_unix/webapp/phpmyadmin_config

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2009-1151

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

    nvd.nist.gov

References