adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions 9 Packages Projects Releases Wiki Activity

automatic module_metadata_base.json update

Browse Source
This commit is contained in:
jenkins-metasploit
2026-04-21 17:21:45 +00:00
parent 4c0f2c29bc
commit 9efc727462
1 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
db/modules_metadata_base.json
+16 -11
View File
@@ -143507,7 +143507,7 @@
"needs_cleanup": true "needs_cleanup": true
}, },
"exploit_unix/webapp/phpmyadmin_config": { "exploit_unix/webapp/phpmyadmin_config": {
"name": "PhpMyAdmin Config File Code Injection", "name": "phpMyAdmin Config File Code Injection",
"fullname": "exploit/unix/webapp/phpmyadmin_config", "fullname": "exploit/unix/webapp/phpmyadmin_config",
"aliases": [], "aliases": [],
"rank": 600, "rank": 600,
@@ -143516,15 +143516,20 @@
"author": [ "author": [
"Greg Ose", "Greg Ose",
"pagvac", "pagvac",
"egypt <egypt@metasploit.com>" "egypt <egypt@metasploit.com>",
"Tenable",
"g0tmi1k"
], ],
"description": "This module exploits a vulnerability in phpMyAdmin's setup\n feature which allows an attacker to inject arbitrary PHP\n code into a configuration file. The original advisory says\n the vulnerability is present in phpMyAdmin versions 2.11.x\n < 2.11.9.5 and 3.x < 3.1.3.1; this module was tested on\n 3.0.1.1.\n\n The file where our payload is written\n (phpMyAdmin/config/config.inc.php) is not directly used by\n the system, so it may be a good idea to either delete it or\n copy the running config (phpMyAdmin/config.inc.php) over it\n after successful exploitation.", "description": "This module exploits a vulnerability in phpMyAdmin's setup\n feature which allows an attacker to inject arbitrary PHP\n code into a configuration file. The original advisory says\n the vulnerability is present in phpMyAdmin versions\n 2.11.x <= 2.11.9.4 and 3.x <= 3.1.3.\n\n There was a follow up vulnerability as the patch was\n incomplete, affecting versions 3.x <= 3.1.3.1.\n\n The file where our payload is written\n (phpMyAdmin/config/config.inc.php) is not directly used by\n the system, so it may be a good idea to either delete it or\n copy the running config (phpMyAdmin/config.inc.php) over it\n after successful exploitation.",
"references": [ "references": [
"CVE-2009-1151", "CVE-2009-1151",
"OSVDB-53076", "OSVDB-53076",
"EDB-8921", "EDB-8921",
"URL-http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php", "URL-https://www.phpmyadmin.net/security/PMASA-2009-3/",
"URL-http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/" "URL-https://web.archive.org/web/20130724101149/http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/",
"CVE-2009-1285",
"URL-https://www.phpmyadmin.net/security/PMASA-2009-4/",
"URL-https://www.tenable.com/security/research/tra-2009-02"
], ],
"platform": "PHP", "platform": "PHP",
"arch": "php", "arch": "php",
@@ -143545,24 +143550,24 @@
"https" "https"
], ],
"targets": [ "targets": [
"Automatic (phpMyAdmin 2.11.x < 2.11.9.5 and 3.x < 3.1.3.1)" "Automatic (phpMyAdmin 2.11.x <= 2.11.9.4 and 3.x <= 3.1.3.1)"
], ],
"mod_time": "2025-06-23 12:43:46 +0000", "mod_time": "2026-04-21 18:43:54 +0000",
"path": "/modules/exploits/unix/webapp/phpmyadmin_config.rb", "path": "/modules/exploits/unix/webapp/phpmyadmin_config.rb",
"is_install_path": true, "is_install_path": true,
"ref_name": "unix/webapp/phpmyadmin_config", "ref_name": "unix/webapp/phpmyadmin_config",
"check": false, "check": true,
"post_auth": false, "post_auth": false,
"default_credential": false, "default_credential": false,
"notes": { "notes": {
"Reliability": [ "Reliability": [
"unknown-reliability" "repeatable-session"
], ],
"Stability": [ "Stability": [
"unknown-stability" "crash-safe"
], ],
"SideEffects": [ "SideEffects": [
"unknown-side-effects" "config-changes"
] ]
}, },
"session_types": false, "session_types": false,