CVE-2009-3697: SQL Injection

Published Oct 16, 2009

Updated

SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.

Affected Software

69 affected components

phpMyAdmin phpMyAdmin=3.0.1.1

phpMyAdmin phpMyAdmin=2.11.4

phpMyAdmin phpMyAdmin=3.2.1

phpMyAdmin phpMyAdmin=3.2.0-beta1

phpMyAdmin phpMyAdmin=2.11.1.2

phpMyAdmin phpMyAdmin=3.1.4

phpMyAdmin phpMyAdmin=3.1.3-1

phpMyAdmin phpMyAdmin=3.1.3

phpMyAdmin phpMyAdmin=2.11.5.1

phpMyAdmin phpMyAdmin=2.11.1

phpMyAdmin phpMyAdmin=2.11.5.0

phpMyAdmin phpMyAdmin=3.2.0

phpMyAdmin phpMyAdmin=3.1.0-beta1

phpMyAdmin phpMyAdmin=3.2.1-rc1

phpMyAdmin phpMyAdmin=3.1.2

phpMyAdmin phpMyAdmin=2.11.9.0

phpMyAdmin phpMyAdmin=3.0.0-beta

phpMyAdmin phpMyAdmin=3.0.0-alpha

phpMyAdmin phpMyAdmin=2.11.9.1

phpMyAdmin phpMyAdmin=2.11.0-beta1

phpMyAdmin phpMyAdmin=2.11.2

phpMyAdmin phpMyAdmin=2.11.7

phpMyAdmin phpMyAdmin=3.1.0

phpMyAdmin phpMyAdmin=2.11.5

phpMyAdmin phpMyAdmin=2.11.5.2

phpMyAdmin phpMyAdmin=2.11.2.2

phpMyAdmin phpMyAdmin=3.0.0

phpMyAdmin phpMyAdmin=2.11.1-rc1

phpMyAdmin phpMyAdmin=3.2.0.1

phpMyAdmin phpMyAdmin=2.11.5-rc1

phpMyAdmin phpMyAdmin=2.11.8

phpMyAdmin phpMyAdmin=3.0.0-rc1

phpMyAdmin phpMyAdmin=2.11.4.0

phpMyAdmin phpMyAdmin=3.1.5-rc1

phpMyAdmin phpMyAdmin=2.11.3

phpMyAdmin phpMyAdmin=2.11.2.1

phpMyAdmin phpMyAdmin=3.1.5

phpMyAdmin phpMyAdmin=3.1.1-rc1

phpMyAdmin phpMyAdmin=3.1.4-rc2

phpMyAdmin phpMyAdmin=2.11.3-rc1

phpMyAdmin phpMyAdmin=2.11.0-rc1

phpMyAdmin phpMyAdmin=2.11.9.5

phpMyAdmin phpMyAdmin=3.1.1

phpMyAdmin phpMyAdmin=2.11.6.0

phpMyAdmin phpMyAdmin=2.11.7.0

phpMyAdmin phpMyAdmin=3.1.3-rc1

phpMyAdmin phpMyAdmin=3.1.3.2

phpMyAdmin phpMyAdmin=2.11.2.0

phpMyAdmin phpMyAdmin=2.11.9.2

phpMyAdmin phpMyAdmin=2.11.9.3

phpMyAdmin phpMyAdmin=2.11.4-rc1

phpMyAdmin phpMyAdmin=2.11.1.1

phpMyAdmin phpMyAdmin=2.11.6

phpMyAdmin phpMyAdmin=3.0.1

phpMyAdmin phpMyAdmin=2.11.9

phpMyAdmin phpMyAdmin=2.11.0beta1

phpMyAdmin phpMyAdmin=3.1.0.0

phpMyAdmin phpMyAdmin=2.11.9.4

phpMyAdmin phpMyAdmin=3.1.3.1

phpMyAdmin phpMyAdmin=2.11.3.0

phpMyAdmin phpMyAdmin=2.11.0.0

phpMyAdmin phpMyAdmin=3.1.2-rc1

phpMyAdmin phpMyAdmin=3.2.0-rc1

phpMyAdmin phpMyAdmin=3.2.2

phpMyAdmin phpMyAdmin=3.0.1-rc1

phpMyAdmin phpMyAdmin=2.11.6-rc1

phpMyAdmin phpMyAdmin=2.11.1.0

phpMyAdmin phpMyAdmin=3.2.2-rc1

phpMyAdmin phpMyAdmin=2.11.0

Remediation

Patch Available

http://www.vupen.com/english/advisories/2009/2899

Event History

Oct 16, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3697?

CVE-2009-3697 is classified as a high-severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2009-3697?

To fix CVE-2009-3697, upgrade phpMyAdmin to version 2.11.9.6 or higher, or 3.2.2.1 or higher.

Which versions of phpMyAdmin are affected by CVE-2009-3697?

CVE-2009-3697 affects phpMyAdmin versions 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1.

Is CVE-2009-3697 an SQL injection vulnerability?

Yes, CVE-2009-3697 is an SQL injection vulnerability found in the PDF schema generator functionality of phpMyAdmin.

Can CVE-2009-3697 lead to data breaches?

Yes, if exploited, CVE-2009-3697 can lead to unauthorized access and potential data breaches due to arbitrary SQL command execution.