PHP code injection in phpMyAdmin setup.php
CVE-2009-1151 is a static code injection vulnerability in phpMyAdmin setup.php affecting phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1. The vulnerable setup functionality allows a remote attacker to supply crafted input to the save action, resulting in arbitrary PHP code being written into a phpMyAdmin configuration file. Because the injected content is stored as PHP in the configuration, the flaw is not limited to data corruption; it enables execution of attacker-controlled PHP when the configuration is later processed by the application.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a Python script (x.py) that is a port of an old Perl scanner/exploit for a phpMyAdmin vulnerability from around 2009. The script takes a list of target hosts and attempts to access the /phpmyadmin/scripts/setup.php endpoint on each, checking for signs of a vulnerable phpMyAdmin installation. If found, it extracts a CSRF token and version information from the response, crafts a serialized PHP object payload (potentially for remote file inclusion or code execution), and sends it via a POST request to the same endpoint. The script uses multithreading to scan multiple hosts in parallel and reports which hosts are vulnerable, including the detected phpMyAdmin version. The main exploit logic is contained in x.py, and there are no other code files. The script is operational and could be used to identify and exploit vulnerable phpMyAdmin instances, but it targets a very old vulnerability and is primarily of historical or educational interest.
This repository contains a Bash proof-of-concept exploit for CVE-2009-1151, a remote code execution vulnerability in phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1. The exploit targets phpMyAdmin installations where the setup wizard was used and the /config/ directory remains present. The main script, minervais.com.phpMyAdminRCE.sh, automates the exploitation process by sending crafted POST requests to /scripts/setup.php to inject PHP code into config.inc.php. Once injected, the attacker can execute arbitrary shell commands or PHP code via HTTP GET parameters to config.inc.php. The repository includes a README with usage instructions and a demonstration. The exploit requires curl and is operational against network-accessible phpMyAdmin instances. No fake or detection-only scripts are present; the code is a functional exploit.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A phpMyAdmin setup-script code injection vulnerability referenced as a historical analogue to the OpenCATS flaw.
A PHP code injection vulnerability in phpMyAdmin used by the Sea Turtle actors for initial access and/or lateral movement.
A PHP code injection vulnerability in phpMyAdmin used by the Sea Turtle actors as a known exploit for initial access and/or lateral movement.
A confirmed phpMyAdmin-related vulnerability used by the LinuQ pack to compromise Linux servers.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.