CVE-2009-1151
phpMyAdmin Remote Code Execution Vulnerability
Description
CVE-2009-1151 is a critical code injection vulnerability affecting phpMyAdmin phpMyAdmin (versions >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1). Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. CISA has added CVE-2009-1151 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 92.96% (99.8th percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| phpmyadmin | phpmyadmin | >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1 |
| debian | debian linux | 4.0; 5.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/(Broken Link)
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html(Product)
- http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301(Vendor Advisory)
- http://secunia.com/advisories/34430(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/34642(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/35585(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/35635(Broken Link, Vendor Advisory)
- http://security.gentoo.org/glsa/glsa-200906-03.xml(Third Party Advisory)
- http://www.debian.org/security/2009/dsa-1824(Mailing List)
- http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/(Exploit, Issue Tracking)
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:115(Broken Link)
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php(Patch, Vendor Advisory)
- http://www.securityfocus.com/archive/1/504191/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/34236(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/8921(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1151(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code Injection is a vulnerability that occurs when software constructs all or part of a code segment using externally-influenced input from an upstream component, but does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Unlike command injection which targets operating system shells, code injection targets the programming language interpreter itself (e.g., Python's eval(), PHP's eval(), JavaScript's eval(), or compiled code generation). In the case of CVE-2009-1151, this weakness manifests in phpMyAdmin phpMyAdmin where setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2009-1151 poses a critical threat to organizations running phpMyAdmin phpMyAdmin, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2009-1151 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 92.96% (99.8th percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Public exploit code is available, lowering the barrier for attackers and increasing the urgency to patch. Despite being over 17 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade phpMyAdmin phpMyAdmin from affected versions (>= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected phpMyAdmin service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to phpMyAdmin.
- Evaluate whether affected phpMyAdmin phpMyAdmin deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2009-1151 is classified under CWE-94 (Improper Control of Generation of Code ('Code Injection')) affecting phpMyAdmin phpMyAdmin in versions >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1. Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2009-1151 being actively exploited?
Yes. CVE-2009-1151 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 92.96% (99.8th percentile) indicates a very high probability of exploitation. Public exploit code is available, further increasing the risk.
What products are affected by CVE-2009-1151?
CVE-2009-1151 primarily affects phpMyAdmin phpMyAdmin, as well as Debian Debian Linux. The affected versions include >= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2009-1151?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (>= 2.11.0, < 2.11.9.5; >= 3.0.0, < 3.1.3.1) to the latest patched release from phpMyAdmin. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2009-1151?
CVE-2009-1151 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.