phpMyAdmin · phpMyAdmin
The phpMyAdmin product has a static code injection flaw in setup.php, affecting phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1, which lets arbitrary PHP code be written into a configuration file via the save action. A remote attacker with network access can exploit it without authentication or user interaction, which permits code execution on the affected server.
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
First seen exploited 10 years after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote attacker exploits web setup script directly.
allows remote attackers to inject arbitrary PHP code
Injected PHP executes as code on server.
inject arbitrary PHP code into a configuration file
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2009-1151 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
CVE-2009-1151: PHP code injection vulnerability affecting phpMyAdminSID: 2281CVE-2014-6271: RCE affecting GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 - 41910CVE-2017-67…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.