CVE-2009-1151
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
96.6%
Published
Mar 26, 2009
CISA due date
Apr 15, 2022
The record
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | phpmyadmin | 0 | 4:3.1.3.1-1 |
| Debian:12 | phpmyadmin | 0 | 4:3.1.3.1-1 |
| Debian:13 | phpmyadmin | 0 | 4:3.1.3.1-1 |
| Debian:4.0 | phpmyadmin | 0 | 4:2.9.1.1-11 |
| Debian:5.0 | phpmyadmin | 0 | 4:2.11.8.1-5+lenny1 |
Related vulnerabilities
- CVE-2025-24530 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin
- CVE-2025-24529 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin
- CVE-2016-5734 phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not… Also affects phpmyadmin
- CVE-2015-6830 libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2… Also affects phpmyadmin
- CVE-2014-9218 libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and… Also affects phpmyadmin
- CVE-2011-4107 The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php)… Also affects phpmyadmin
- CVE-2011-2505 libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in… Also affects phpmyadmin
- CVE-2010-3055 The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before… Also affects phpmyadmin