VulnerabilityAnalyzed
CVE-2009-1151
phpMyAdmin Remote Code Execution Vulnerability
KEVCRITICAL 9.8EPSS 96.6%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 96.56% probability · 100th percentile
- CISA KEV
- Listed 25 March 2022 · due 15 April 2022
- Weakness
- CWE-94
- Affected
- phpmyadmin/phpmyadmin · debian/debian linux
- Source
- cve@mitre.org
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2009-1151
References
- http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlProduct
- http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301Vendor Advisory
- http://secunia.com/advisories/34430Broken Link, Vendor Advisory
- http://secunia.com/advisories/34642Broken Link, Vendor Advisory
- http://secunia.com/advisories/35585Broken Link, Vendor Advisory
- http://secunia.com/advisories/35635Broken Link, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200906-03.xmlThird Party Advisory
- http://www.debian.org/security/2009/dsa-1824Mailing List
- http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/Exploit, Issue Tracking
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:115Broken Link
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.phpPatch, Vendor Advisory
- http://www.securityfocus.com/archive/1/504191/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/34236Broken Link, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/8921Exploit, Third Party Advisory, VDB Entry
- http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlProduct
- http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301Vendor Advisory
- http://secunia.com/advisories/34430Broken Link, Vendor Advisory
- http://secunia.com/advisories/34642Broken Link, Vendor Advisory
- http://secunia.com/advisories/35585Broken Link, Vendor Advisory
- http://secunia.com/advisories/35635Broken Link, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200906-03.xmlThird Party Advisory
- http://www.debian.org/security/2009/dsa-1824Mailing List
- http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/Exploit, Issue Tracking
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:115Broken Link
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.phpPatch, Vendor Advisory
- http://www.securityfocus.com/archive/1/504191/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/34236Broken Link, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/8921Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.