CVE-2009-1151: phpMyAdmin Remote Code Execution Vulnerability
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
Other sources
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 2.11.9.5 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 3.1.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1151?
CVE-2009-1151 is classified as a medium severity vulnerability that allows arbitrary PHP code injection in affected versions of phpMyAdmin.
How do I fix CVE-2009-1151?
To fix CVE-2009-1151, upgrade to phpMyAdmin version 2.11.9.5 or later, or 3.1.3.1 or later.
What versions of phpMyAdmin are affected by CVE-2009-1151?
CVE-2009-1151 affects phpMyAdmin versions 2.11.0 through 2.11.9.4 and 3.0.0 through 3.1.3.
How can CVE-2009-1151 be exploited?
CVE-2009-1151 can be exploited by sending a crafted POST request to the setup script, allowing attackers to inject arbitrary PHP code.
Is there a patch available for CVE-2009-1151?
Yes, the developers released updates for phpMyAdmin that address CVE-2009-1151, resolving the code injection vulnerability.