Evil-DB LogoEvil-DB
← All CVEs

CVE-2009-1285

high · 7.5

Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.

7.5
CVSS
10.9%
EPSS (exploit prob.)
96th
EPSS percentile
2009-04-16
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

VendorProductAffected versions
phpmyadminphpmyadmin3.0.0
phpmyadminphpmyadmin3.0.1
phpmyadminphpmyadmin3.1.0
phpmyadminphpmyadmin3.1.0.0
phpmyadminphpmyadmin3.1.1
phpmyadminphpmyadmin3.1.1
phpmyadminphpmyadmin3.1.2
phpmyadminphpmyadmin3.1.2
phpmyadminphpmyadmin3.1.3
phpmyadminphpmyadmin3.1.3
phpmyadminphpmyadmin3.1.3
phpmyadminphpmyadmin3.1.3.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-1285