Published: 26/03/2009 Updated: 10/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 766

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x prior to 2.11.9.5 and 3.x prior to 3.1.3.1 allows remote malicious users to inject arbitrary PHP code into a configuration file via the save action.

Vulnerable Product	Search on Vulmon	Subscribe to Product
phpmyadmin phpmyadmin
phpmyadmin phpmyadmin 2.11.9.4
phpmyadmin phpmyadmin 2.11.9.2
phpmyadmin phpmyadmin 2.11.6
phpmyadmin phpmyadmin 2.11.6.0
phpmyadmin phpmyadmin 2.11.4
phpmyadmin phpmyadmin 2.11.1
phpmyadmin phpmyadmin 2.11.1.2
phpmyadmin phpmyadmin 3.1.2
phpmyadmin phpmyadmin 3.1.1
phpmyadmin phpmyadmin 2.11.9
phpmyadmin phpmyadmin 2.11.8
phpmyadmin phpmyadmin 2.11.5.2
phpmyadmin phpmyadmin 2.11.5.1
phpmyadmin phpmyadmin 2.11.3
phpmyadmin phpmyadmin 2.11.2.2
phpmyadmin phpmyadmin 2.11.2.1
phpmyadmin phpmyadmin 2.11.0
phpmyadmin phpmyadmin 3.1.3
phpmyadmin phpmyadmin 2.11.9.1
phpmyadmin phpmyadmin 2.11.9.0
phpmyadmin phpmyadmin 2.11.5
phpmyadmin phpmyadmin 2.11.3.0
phpmyadmin phpmyadmin 2.11.1.1
phpmyadmin phpmyadmin 2.11.1.0
phpmyadmin phpmyadmin 3.1.0
phpmyadmin phpmyadmin 2.11.9.3
phpmyadmin phpmyadmin 2.11.7.0
phpmyadmin phpmyadmin 2.11.7
phpmyadmin phpmyadmin 2.11.5.0
phpmyadmin phpmyadmin 2.11.2.0
phpmyadmin phpmyadmin 2.11.2

Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1150 Cross site scripting vulnerability in the export page allow for an attacker that can place crafted cookies with the user to inject arbitr ...

phpMyAdmin /scripts/setupphp PHP code injection remote command execution proof of concept exploit Versions 3011 and below are affected ...

<?php $list = array( '/phpmyadmin/', '/phpMyAdmin/', '/PMA/', '/pma/', '/admin/', '/dbadmin/', '/mysql/', '/myadmin/', '/phpmyadmin2/', '/phpMyAdmin2/', '/phpMyAdmin-2/', '/php-my-admin/', '/phpMyAdmin-223/', '/phpMyAdmin-226/', '/phpMyAdmin-251/', '/phpMyAdmin-254/', '/phpMyAdmin-255-rc1/', '/phpMyAdmin-255-rc2/', ' ...

## # $Id: phpmyadmin_configrb 9669 2010-07-03 03:13:45Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' clas ...

#!/bin/bash # CVE-2009-1151: phpMyAdmin '/scripts/setupphp' PHP Code Injection RCE PoC v011 # by pagvac (gnucitizenorg), 4th June 2009 # special thanks to Greg Ose (labsneohapsiscom) for discovering such a cool vuln, # and to str0ke (milw0rmcom) for testing this PoC script and providing feedback! # PoC script successfully tested on the fo ...

phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE PoC (CVE-2009-1151)

minervaiscomphpMyAdminRCEsh phpMyAdmin '/scripts/setupphp' PHP Code Injection RCE POC This was the first publicly-released exploit for CVE-2009-1151 Syntax $ /phpMyAdminRCEsh usage: /phpMyAdminRCEsh <phpMyAdmin_base_URL> ie: /phpMyAdminRCEsh targettld/phpMyAdmin/ Demo $ /phpMyAdminRCEsh http

phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE PoC (CVE-2009-1151)

minervaiscomphpMyAdminRCEsh phpMyAdmin '/scripts/setupphp' PHP Code Injection RCE POC This was the first publicly-released exploit for CVE-2009-1151 Syntax $ /phpMyAdminRCEsh usage: /phpMyAdminRCEsh <phpMyAdmin_base_URL> ie: /phpMyAdminRCEsh targettld/phpMyAdmin/ Demo $ /phpMyAdminRCEsh http

CWE-94 http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301 http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php http://secunia.com/advisories/34430 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://secunia.com/advisories/34642 http://www.mandriva.com/security/advisories?name=MDVSA-2009:115 http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/http://www.securityfocus.com/bid/34236 http://www.debian.org/security/2009/dsa-1824 http://secunia.com/advisories/35585 http://security.gentoo.org/glsa/glsa-200906-03.xml http://secunia.com/advisories/35635 https://www.exploit-db.com/exploits/8921 http://www.securityfocus.com/archive/1/504191/100/0/threaded https://nvd.nist.gov https://www.debian.org/security/./dsa-1824 https://github.com/pagvac/minervais.com.phpMyAdminRCE https://www.exploit-db.com/exploits/8992/

CVE-2009-1151

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect