References https://zone.ci/aliyun/ali_highrisk/12544.html https://avd.aliyun.com/detail?id=AVD-2009-1151 https://www.tenablecloud.cn/plugins/nessus/36170 https://blog.csdn.net/m0_47418965/article/details/121708917 https://gist.github.com/46defbc8c0111143ef33 https://cve.imfht.com/poc_detail/021e21e8efd9f56049ebff10e93406e75da104e5 https://www.phpmyadmin.net/security/PMASA-2009-3/ https://nvd.nist.gov/vuln/detail/cve-2009-1151 https://www.rapid7.com/db/modules/exploit/unix/webapp/phpmyadmin_config/ https://support.alertlogic.com/hc/en-us/articles/360002868452-Web-Server-phpMyAdmin-setup-php-Code-Injection https://www.exploit-db.com/exploits/16913 https://blog.51cto.com/secode/168264 https://developer.aliyun.com/article/533666
Related VulnerabilitiesPoCCVE-2020-26935: phpMyAdmin < 5.0.3 - SQL InjectionPoCphpmyadmin-fpd: phpMyAdmin - Full Path DisclosurePoCCVE-2009-1151: PhpMyAdmin Scripts - Remote Code ExecutionPoCCVE-2018-12613: PhpMyAdmin <4.8.2 - Local File InclusionPoCCVE-2019-6799: phpMyAdmin <4.8.5 - Local File InclusionPoCCVE-2020-11441: phpMyAdmin 5.0.2 - CRLF InjectionPoCCVE-2022-23808: phpMyAdmin < 5.1.2 - Cross-Site ScriptingPoCCVE-2018-12613: PhpMyAdmin 4.8.1 Remote File InclusionPoCphpmyadmin-default-login: phpMyAdmin - Default LoginPoCphpmyadmin-misconfiguration: Sensitive data exposurePoCphpmyadmin-server-import: PhpMyAdmin Server ImportPoCphpmyadmin-setup-deserialization: Phpmyadmin Setup DeserializationPoCphpmyadmin-setup: Publicly Accessible Phpmyadmin Setup