Description
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:2.11.8.1-2 | — |
| Debian 13 | phpmyadmin | 4:2.11.8.1-2 | — |
| Debian 12 | phpmyadmin | 4:2.11.8.1-2 | — |
| Debian 4.0 | phpmyadmin | 4:2.9.1.1-8 | DSA-1641-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- phpMyAdmin 3.2 - 'server_databases.php' Remote Command Execution EDB-32383 · webapps · Sep 15, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1641-1 phpmyadmin - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2008:202 vendor-advisory
- 31884 third-party-advisory
- 31918 third-party-advisory
- SUSE-SR:2009:003 vendor-advisory
- FEDORA-2008-8370 vendor-advisory
- ADV-2008-2585 vdb-entry
- FEDORA-2008-8269 vendor-advisory
- 48196 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=462430
- [oss-security] 20080915 phpMyAdmin code execution (CVE request) mailing-list
- http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/
- GLSA-200903-32 vendor-advisory
- FEDORA-2008-8335 vendor-advisory
- FEDORA-2008-8286 vendor-advisory
- phpmyadmin-serverdatabases-code-execution(45157) vdb-entry
- DSA-1641 vendor-advisory
- 33822 third-party-advisory
- 31188 vdb-entry
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7
- 32034 third-party-advisory
- [phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released mailing-list
- http://fd.the-wildcat.de/pma_e36a091q11.php
- [oss-security] 20080915 Re: phpMyAdmin code execution (CVE request) mailing-list
- ADV-2008-2619 vdb-entry