VulnerabilityModified
CVE-2009-3697
SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
HIGH 7.5EPSS 2.60%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.60% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- phpmyadmin/phpmyadmin
- Source
- cve@mitre.org
References
- http://bugs.gentoo.org/show_bug.cgi?id=288899
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html
- http://freshmeat.net/projects/phpmyadmin/releases/306667
- http://freshmeat.net/projects/phpmyadmin/releases/306669
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://marc.info/?l=oss-security&m=125553728512853&w=2
- http://marc.info/?l=oss-security&m=125561979001460&w=2
- http://secunia.com/advisories/37016Vendor Advisory
- http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:274
- http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.phpVendor Advisory
- http://www.securityfocus.com/bid/36658
- http://www.vupen.com/english/advisories/2009/2899Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=528769
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53741
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html
- http://bugs.gentoo.org/show_bug.cgi?id=288899
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html
- http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html
- http://freshmeat.net/projects/phpmyadmin/releases/306667
- http://freshmeat.net/projects/phpmyadmin/releases/306669
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://marc.info/?l=oss-security&m=125553728512853&w=2
- http://marc.info/?l=oss-security&m=125561979001460&w=2
- http://secunia.com/advisories/37016Vendor Advisory
- http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.