CVE-2009-1151

phpMyAdmin Remote Code Execution Vulnerability

Phpmyadmin

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

26. Mär 2009

Ausgewertete Quellen

• Debian
  http://www.debian.org/security/2009/dsa-1824
• Hersteller
  http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301
• Hersteller
  http://secunia.com/advisories/34430
• Hersteller
  http://secunia.com/advisories/34642
• Hersteller
  http://secunia.com/advisories/35585
• Hersteller
  http://secunia.com/advisories/35635
• Hersteller
  http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php
• Hinweis
  http://security.gentoo.org/glsa/glsa-200906-03.xml
• Hinweis
  http://www.securityfocus.com/archive/1/504191/100/0/threaded
• Hinweis
  http://www.securityfocus.com/bid/34236
• Hinweis
  https://www.exploit-db.com/exploits/8921
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1151
• CISA
  phpMyAdmin Remote Code Execution Vulnerability
• NVD
  CVE-2009-1151