---
id: "CVE-2009-1151"
kind: "vulnerability"
aliases: ["CVE-2009-1151"]
title: "phpMyAdmin phpMyAdmin: phpMyAdmin Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.96565
exploited: true
status: "open"
category: "runtime"
products: [{"name": "phpMyAdmin phpMyAdmin", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "phpMyAdmin", "fixed": ["2.11.9.5", "3.1.3.1"], "affected": ">= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "php", "phpmyadmin", "runtime", "self-hosted"]
not_affected_if: ["config-dir-not-writable", "managed-hosting", "setup-removed", "setup-script-removed"]
published_at: "2009-03-26T14:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1151", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-1151", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:22:34+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1151", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# phpMyAdmin phpMyAdmin: phpMyAdmin Remote Code Execution Vulnerability

phpMyAdmin's setup script (setup.php, save action) can be fooled by a crafted POST into writing arbitrary PHP into the generated config file. Unauthenticated RCE is possible if the web server can write to the config/ directory. Fixed in 2.11.9.5 and 3.1.3.1 (2009). Listed in CISA KEV and has a public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:phpMyAdmin phpMyAdmin affected ? fixed ?
- vendor:phpMyAdmin affected >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1 fixed 2.11.9.5, 3.1.3.1

## How to check

Check the phpMyAdmin version (login page footer or README/Documentation.html). Anything 2.11.x below 2.11.9.5, or 3.x below 3.1.3.1, is affected. Also check whether a setup/ (or scripts/setup.php) path is reachable from the web and whether a web-server-writable config/ directory exists. Look for unexpected PHP in config/config.inc.php.

## Fix

Upgrade to phpMyAdmin 2.11.9.5 or 3.1.3.1 or later (in practice, a current supported release). Remove the setup/ directory and the writable config/ directory after installation. Check config.inc.php for injected code.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1151
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-1151
- 2026-10-23T21:22:34+00:00 analyst — Read PMASA-2009-3 (vendor) and NVD: affected 2.11.x <2.11.9.5 and 3.x <3.1.3.1; fixed 2.11.9.5 / 3.1.3.1. Exploitation needs a web-server-writable config/ directory (vendor mitigation factor), created by the admin during setup. KEV-listed; public PoC per NVD ref Exploit-DB 8921 (page not read by me, listed by NVD as Exploit). Did not read X.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-1151

## Documents

- [advisory] PMASA-2009-3 https://www.phpmyadmin.net/security/PMASA-2009-3/
- [describes] NVD CVE-2009-1151 https://nvd.nist.gov/vuln/detail/CVE-2009-1151
- [poc] Exploit-DB 8921 (listed by NVD) https://www.exploit-db.com/exploits/8921

## From the sources

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_