CVE-2009-1151

A crafted POST request to phpMyAdmin's setup script can inject arbitrary PHP code into the generated configuration file, enabling remote code execution.

An attacker can trick the setup script into including malicious PHP code in the configuration file, granting remote code execution. DIB organizations must ensure setup scripts are never executed in production and that phpMyAdmin is patched to prevent exploitation of this actively exploited vulnerability.

Shame score — This vulnerability is actively exploited in the wild and allows remote code execution, representing a severe, avoidable security failure.