CVE-2009-1151: phpMyAdmin setup.php code injection enables remote PHP execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8, KEV listing, near-maximum EPSS, and public exploits make this an urgent patch.

What it is

phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 contains a static code injection flaw in setup.php. The save action lets a remote attacker write arbitrary PHP code into a configuration file, which is then executed by the server. Because the vulnerable setup script is reachable without authentication, this is a full remote code execution issue.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the web server, leading to full compromise of the phpMyAdmin host and any database credentials it holds. This can expose or destroy the underlying database contents.

Attack surface

Reached over the network through the setup.php script's save action; the CVSS vector shows no privileges or user interaction required. Any exposed phpMyAdmin setup interface is directly attackable.

Exploitation

CISA added it to KEV in March 2022, EPSS is 0.966 at the 99.88th percentile, and public proof-of-concept and Exploit-DB references exist, so exploitation is widespread and reliable. No ransomware campaign use is documented.

What to do

• Upgrade phpMyAdmin to 2.11.9.5 or 3.1.3.1 (or later) immediately.
• Remove or block access to the setup directory and setup.php on production systems.
• Restrict phpMyAdmin access to trusted management networks or require authentication in front of it.
• Audit the phpMyAdmin config file for injected PHP code and restore it from a known-good copy.
• Rotate database credentials and any secrets stored in the phpMyAdmin configuration.

Detection

• Monitor web logs for POST requests to setup.php with a save action or PHP code in parameters.
• Alert on unexpected modifications to phpMyAdmin config files, especially added PHP tags.
• Scan for web-accessible setup directories and exposed phpMyAdmin instances.
• Review server processes and outbound connections for signs of injected PHP execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.