Critical Static Code Injection Vulnerability in phpMyAdmin
Summary
CVE-2009-1151: Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Affects phpmyadmin versions < 4:3.1.3.1-1. Fixed in 4:3.1.3.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to perform database operations such as creating, modifying, and deleting databases and tables. However, certain versions of phpMyAdmin are vulnerable to static code injection, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2009-1151 is a static code injection flaw found in setup.php of phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1. This vulnerability allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. If successfully exploited, this could lead to unauthorized access, data manipulation, and potentially complete control over the affected server.
How To Fix
Minimum fixed version
4:3.1.3.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider restricting access to the phpMyAdmin setup.php file by modifying your web server configuration to deny access to this file. For example, in an Apache server, you can add the following lines to your .htaccess file:
<Files "setup.php">
Order Allow,Deny
Deny from all
Conclusion
CVE-2009-1151 represents a significant security risk for users of vulnerable phpMyAdmin versions. It is crucial to upgrade to the latest version to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2009-1151 is a static code injection vulnerability in phpMyAdmin that allows remote attackers to inject arbitrary PHP code into a configuration file.
The vulnerability affects phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and full control over the affected server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2009-1151 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
