CVE-2013-5003: SQL Injection

Published Jul 30, 2013

Updated

Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmdpdf.php or (2) the pdfpagenumber parameter to schemaexport.php.

Affected Software

22 affected components

phpMyAdmin phpMyAdmin=3.5.0.0

phpMyAdmin phpMyAdmin=3.5.1.0

phpMyAdmin phpMyAdmin=3.5.2.0

phpMyAdmin phpMyAdmin=3.5.2.1

phpMyAdmin phpMyAdmin=3.5.2.2

phpMyAdmin phpMyAdmin=3.5.3.0

phpMyAdmin phpMyAdmin=3.5.4

phpMyAdmin phpMyAdmin=3.5.5

phpMyAdmin phpMyAdmin=3.5.6

phpMyAdmin phpMyAdmin=3.5.7

phpMyAdmin phpMyAdmin=3.5.7-rc1

phpMyAdmin phpMyAdmin=3.5.8

phpMyAdmin phpMyAdmin=3.5.8-rc1

phpMyAdmin phpMyAdmin=3.5.8.1

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.0-rc2

phpMyAdmin phpMyAdmin=4.0.0-rc3

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

Event History

Jul 30, 2013

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5003?

CVE-2013-5003 has been classified as a high-severity vulnerability due to the potential for remote SQL injection attacks.

How do I fix CVE-2013-5003?

To fix CVE-2013-5003, you should upgrade phpMyAdmin to version 3.5.8.2 or later, or 4.0.4.2 or later.

Who is affected by CVE-2013-5003?

CVE-2013-5003 affects phpMyAdmin versions 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2.

What types of SQL injection vulnerabilities are present in CVE-2013-5003?

CVE-2013-5003 allows remote authenticated users to execute arbitrary SQL commands using specific parameters in phpMyAdmin.

Can I manually secure phpMyAdmin from CVE-2013-5003?

While upgrading is the recommended approach, you can also employ input validation and sanitization to reduce the risk of SQL injection.