Actively exploited · CISA KEV · NVD published 2009-03-26
Actively exploitedCVE-2009-1151
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
- First PoC
- 6161 days →Metasploit
- 178 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2022-03-25 · due 2022-04-15. An observation, not a forecast.
- EPSS · 30-day forecast
- 97%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
5 known · links onlyMetasploit1
This module exploits a vulnerability in phpMyAdmin's setup feature which allows an attacker to inject arbitrary PHP code into a configuration file. The original advisory says the vulnerability is present in phpMyAdmin versions 2.11.x <= 2.11.9.4 and 3.x <= 3.1.3. There was a follow up vulnerability as the patch was incomplete, affecting versions 3.x <= 3.1.3.1. The file where our payload is written (phpMyAdmin/conf
ruby · seen 2026-10-18
Exploit-DB3
created 2009-06-09
created 2009-06-22
created 2010-07-03
Nuclei1
PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
yaml · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.