CVE-2009-3758: SQL Injection
Published Oct 22, 2009
·Updated
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.
Affected Software
1 affected component
Citrix XenCenterWeb
Event History
Oct 22, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3758?
The severity of CVE-2009-3758 is considered critical due to the potential for remote SQL injection attacks.
2
How do I fix CVE-2009-3758?
To fix CVE-2009-3758, ensure that proper input validation and parameterized queries are implemented in the login.php script.
3
Which software is affected by CVE-2009-3758?
CVE-2009-3758 affects the Citrix XenCenterWeb software.
4
What type of vulnerability is CVE-2009-3758?
CVE-2009-3758 is classified as an SQL injection vulnerability.
5
Can CVE-2009-3758 allow attackers to access the database?
Yes, CVE-2009-3758 can allow attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to the database.