phpMyAdmin Remote Code Execution Vulnerability

Published Mar 25, 2022·Updated Jun 16, 2026

NVD Description

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

Public Exploits & PoCs3 found

PoC: pocs

phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE PoC (CVE-2009-1151)

PoC: ZmEu

CVE-2009-1151, phpMyAdmin의 set.up

PoC: PhpMyAdmin

Based on the x.pl exploit/loader script for CVE-2009-1151

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free