{"id":"CVE-2009-1151","kind":"vulnerability","aliases":["CVE-2009-1151"],"related":[],"title":"phpMyAdmin phpMyAdmin: phpMyAdmin Remote Code Execution Vulnerability","description":"Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.\n\nCISA required action: Apply updates per vendor instructions.","summary":"phpMyAdmin's setup script (setup.php, save action) can be fooled by a crafted POST into writing arbitrary PHP into the generated config file. Unauthenticated RCE is possible if the web server can write to the config/ directory. Fixed in 2.11.9.5 and 3.1.3.1 (2009). Listed in CISA KEV and has a public PoC.","severity":"critical","cvss":9.8,"epss":0.96565,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"phpMyAdmin phpMyAdmin","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"phpMyAdmin","fixed":["2.11.9.5","3.1.3.1"],"affected":">= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","php","phpmyadmin","runtime","self-hosted"],"not_affected_if":["config-dir-not-writable","managed-hosting","setup-removed","setup-script-removed"],"how_to_check":"Check the phpMyAdmin version (login page footer or README/Documentation.html). Anything 2.11.x below 2.11.9.5, or 3.x below 3.1.3.1, is affected. Also check whether a setup/ (or scripts/setup.php) path is reachable from the web and whether a web-server-writable config/ directory exists. Look for unexpected PHP in config/config.inc.php.","fix":"Upgrade to phpMyAdmin 2.11.9.5 or 3.1.3.1 or later (in practice, a current supported release). Remove the setup/ directory and the writable config/ directory after installation. Check config.inc.php for injected code.","status":"open","published_at":"2009-03-26T14:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:03+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T21:22:03Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","reach":"internet","impact":"high","summary":"phpMyAdmin's setup script can be tricked by a crafted POST request into writing arbitrary PHP code into the generated configuration file. An attacker who gets that PHP code executed gets code execution on the server.","category":"runtime","who_cares":["phpmyadmin","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary PHP code on the server via configuration file","analyst_note":"Find the fixed phpMyAdmin version and whether the setup/ directory must be present for exploitation; check the NVD or phpMyAdmin advisory for CVE-2009-1151.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["setup-script-removed","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00046,"input_tokens":2837,"output_tokens":353,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed phpMyAdmin version and whether the setup/ directory must be present for exploitation; check the NVD or phpMyAdmin advisory for CVE-2009-1151.","search":"'-1151':10A,13A '-2009':9A,12A '2.11.9.5':63B '2009':66B '3.1.3.1':65B 'action':30B,101C 'appli':102C 'arbitrari':40B,92C 'cisa':69B,99C 'code':5A,94C 'config':45B,59B 'configur':81C,97C 'craft':36B,87C 'cve':8A,11A 'directori':60B 'execut':6A 'exploit':17B 'file':46B,98C 'fix':61B 'fool':33B,84C 'generat':44B,80C,96C 'host':23B 'includ':91C 'instruct':106C 'kev':70B 'list':67B 'per':104C 'php':18B,41B,93C 'phpmyadmin':1A,2A,3A,14A,15A,16A,19B,24B 'poc':75B 'possibl':50B 'post':37B,88C 'public':74B 'rce':48B 'remot':4A 'request':89C 'requir':100C 'runtim':20B 'save':29B 'script':27B,77C 'self':22B 'self-host':21B 'server':54B 'setup':26B,76C 'setup.php':28B 'unauthent':47B 'updat':103C 'use':78C,85C 'vendor':105C 'vulner':7A 'web':53B 'write':39B,56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-03-26T14:30:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2009-1151","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1151","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2009-1151","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-1151","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2009-1151:61","url":null,"severity":null,"published_at":"2026-10-23T21:22:34+00:00","modified_at":"2026-10-23T21:22:34+00:00","first_seen_at":"2026-10-23T21:22:34+00:00","fetched_at":"2026-10-23T21:22:34+00:00","note":"Read PMASA-2009-3 (vendor) and NVD: affected 2.11.x <2.11.9.5 and 3.x <3.1.3.1; fixed 2.11.9.5 / 3.1.3.1. Exploitation needs a web-server-writable config/ directory (vendor mitigation factor), created by the admin during setup. KEV-listed; public PoC per NVD ref Exploit-DB 8921 (page not read by me, listed by NVD as Exploit). Did not read X."},{"source":"nvd","external_id":"CVE-2009-1151","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1151","severity":null,"published_at":"2009-03-26T14:30:00+00:00","modified_at":"2026-06-16T23:06:36+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":952,"url":"https://www.phpmyadmin.net/security/PMASA-2009-3/","title":"PMASA-2009-3","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":953,"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1151","title":"NVD CVE-2009-1151","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":954,"url":"https://www.exploit-db.com/exploits/8921","title":"Exploit-DB 8921 (listed by NVD)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}