CVE-2009-1285 is a static code injection vulnerability affecting phpMyAdmin 3.x versions prior to 3.1.3.2. Specifically, it resides in the getConfigFile function within setup/lib/ConfigFile.class.php, allowing remote attackers to inject arbitrary PHP code into configuration files. This vulnerability carries a CVSS score of 7.5 (High), indicating a critical risk due to its network-based attack vector, low access complexity, and potential for partial compromise of confidentiality, integrity, and availability. While no active exploitation, Metasploit modules, or ExploitDB entries are reported, and community discussion is minimal, the potential for remote code execution makes it a significant concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.0CPE matchmatch criteria | cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:* | ||
3.0.1CPE matchmatch criteria | cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:* | ||
3.1.0CPE matchmatch criteria | cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:* | ||
3.1.0.0CPE matchmatch criteria | cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:* | ||
3.1.1CPE matchmatch criteria | cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
[R1] phpMyAdmin < 3.1.3.2 Multiple Vulnerabilities
Apr 14, 2009[R1] phpMyAdmin < 3.1.3.2 Multiple Vulnerabilities
Apr 14, 2009[R1] phpMyAdmin < 3.1.3.2 Multiple Vulnerabilities
Apr 14, 2009[R1] phpMyAdmin < 3.1.3.2 Multiple Vulnerabilities
Apr 14, 2009phpMyAdmin: Insufficient output sanitizing when generating configuration file fixed in 3.1.3.2 (PMASA-2009-4)