Live › vulnerability › CVE-2009-1151
Go to dashboardphpMyAdmin's setup script (setup.php, save action) can be fooled by a crafted POST into writing arbitrary PHP into the generated config file. Unauthenticated RCE is possible if the web server can write to the config/ directory. Fixed in 2.11.9.5 and 3.1.3.1 (2009). Listed in CISA KEV and has a public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| phpMyAdmin phpMyAdmin | vendor | – | – |
| phpMyAdmin | vendor | >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1 | 2.11.9.5, 3.1.3.1 |
2.11.9.5, or 3.x below 3.1.3.1, is affected2.11.9.5 or 3.1.3.1 or later (in practice, a current supported release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2009-1151")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.