CVE-2015-2208: phpMoAdmin moadmin.php saveObject command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with public exploit code and a very high EPSS score makes this an urgent risk for any exposed phpMoAdmin instance.

What it is

The saveObject function in moadmin.php in phpMoAdmin 1.1.2 passes the object parameter to a shell without sanitizing shell metacharacters, allowing command injection. Because phpMoAdmin is a MongoDB administration tool, this flaw lets an unauthenticated remote attacker run arbitrary commands on the host.

Impact

An attacker can execute arbitrary operating system commands with the privileges of the web server, leading to full compromise of the host and any data reachable from it.

Attack surface

Reachable over the network via HTTP requests to moadmin.php; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced in multiple sources (Packet Storm, Full Disclosure, Exploit-DB, oss-security), and EPSS is 0.61959 (99th percentile), though CISA KEV does not list it.

What to do

• Upgrade phpMoAdmin to a version that fixes the command injection, or remove the product if no fixed release exists.
• Restrict network access to moadmin.php so it is not reachable from untrusted networks.
• Require authentication and place the admin interface behind a reverse proxy or VPN.
• Run the web server with least privilege and disable unnecessary shell execution paths.
• Monitor for and block requests containing shell metacharacters in the object parameter.

Detection

• Inspect HTTP requests to moadmin.php for shell metacharacters such as ;, |, &, $, and backticks in the object parameter.
• Monitor web server and process logs for unexpected child processes spawned by the web server user.
• Alert on outbound network connections or file writes originating from the phpMoAdmin process.
• Use the public Exploit-DB and Packet Storm signatures to scan for known exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.