Critical severity9.8CISA KEVNVD Advisory· Published Mar 26, 2009· Updated Jun 16, 2026
CVE-2009-1151
CVE-2009-1151
Description
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*range: >=2.11.0,<2.11.9.5
- (no CPE)range: >=2.11.0, <2.11.9.5 || >=3.0, <3.1.3.1
Patches
Vulnerability mechanics
References
16- www.phpmyadmin.net/home_page/security/PMASA-2009-3.phpnvdPatchVendor Advisory
- www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/nvdExploitIssue Tracking
- www.exploit-db.com/exploits/8921nvdExploitThird Party AdvisoryVDB Entry
- phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.phpnvdVendor Advisory
- secunia.com/advisories/34430nvdBroken LinkVendor Advisory
- secunia.com/advisories/34642nvdBroken LinkVendor Advisory
- secunia.com/advisories/35585nvdBroken LinkVendor Advisory
- secunia.com/advisories/35635nvdBroken LinkVendor Advisory
- security.gentoo.org/glsa/glsa-200906-03.xmlnvdThird Party Advisory
- www.securityfocus.com/archive/1/504191/100/0/threadednvdBroken LinkThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/34236nvdBroken LinkThird Party AdvisoryVDB Entry
- labs.neohapsis.com/2009/04/06/about-cve-2009-1151/nvdBroken Link
- lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlnvdProduct
- www.debian.org/security/2009/dsa-1824nvdMailing List
- www.mandriva.com/security/advisoriesnvdBroken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.