CVE-2009-1151

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 96,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada phpmyadmin, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Rincian

Terbit di NVD

26 Maret 2009

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

96,6% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

phpMyAdmin Remote Code Execution Vulnerability

Masuk KEV

25 Maret 2022

Tenggat CISA

15 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=... advisory vendor
• http://secunia.com/advisories/34430 broken link · advisory vendor
• http://secunia.com/advisories/34642 broken link · advisory vendor
• http://secunia.com/advisories/35585 broken link · advisory vendor
• http://secunia.com/advisories/35635 broken link · advisory vendor
• http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1151 pemerintah AS
• http://security.gentoo.org/glsa/glsa-200906-03.xml advisory pihak ketiga
• http://www.securityfocus.com/archive/1/504191/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/34236 broken link · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/8921 exploit · advisory pihak ketiga · vdb entry
• http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/ exploit · issue tracking
• http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/ broken link
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html product
• http://www.debian.org/security/2009/dsa-1824 mailing list
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:115 broken link