NVD Vulnerability Detail

CVE-2009-3697

Summary	SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
Summary	Vulnerabilidad de inyección SQL en la funcionalidad generador de esquema PDF en phpMyAdmin v2.11.x anterior a v2.11.9.6 y v3.x anterior a v3.2.2.1 permite a atacantes remotos ejecutar comandos SQL a su elección a través de parámetros de la interfaz no especificados.
Publication Date	Oct. 17, 2009, 1:30 a.m.
Registration Date	Jan. 29, 2021, 1:24 p.m.
Last Update	April 23, 2026, 9:35 a.m.

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-alpha:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-beta:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0-beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1::::::

Related information, measures and tools

No	URL	refsource
1	http://bugs.gentoo.org/show_bug.cgi?id=288899	cve@mitre.org
2	http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html	cve@mitre.org
3	http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html	cve@mitre.org
4	http://freshmeat.net/projects/phpmyadmin/releases/306667	cve@mitre.org
5	http://freshmeat.net/projects/phpmyadmin/releases/306669	cve@mitre.org
6	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html	cve@mitre.org
7	http://marc.info/?l=oss-security&m=125553728512853&w=2	cve@mitre.org
8	http://marc.info/?l=oss-security&m=125561979001460&w=2	cve@mitre.org
9	http://secunia.com/advisories/37016	cve@mitre.org
10	http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/	cve@mitre.org
11	http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/	cve@mitre.org
12	http://www.mandriva.com/security/advisories?name=MDVSA-2009:274	cve@mitre.org
13	http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php	cve@mitre.org
14	http://www.securityfocus.com/bid/36658	cve@mitre.org
15	http://www.vupen.com/english/advisories/2009/2899	cve@mitre.org
16	https://bugzilla.redhat.com/show_bug.cgi?id=528769	cve@mitre.org
17	https://exchange.xforce.ibmcloud.com/vulnerabilities/53741	cve@mitre.org
18	https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html	cve@mitre.org
19	https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html	cve@mitre.org
20	http://bugs.gentoo.org/show_bug.cgi?id=288899	af854a3a-2127-422b-91ae-364da2661108
21	http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html	af854a3a-2127-422b-91ae-364da2661108
22	http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html	af854a3a-2127-422b-91ae-364da2661108
23	http://freshmeat.net/projects/phpmyadmin/releases/306667	af854a3a-2127-422b-91ae-364da2661108
24	http://freshmeat.net/projects/phpmyadmin/releases/306669	af854a3a-2127-422b-91ae-364da2661108
25	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html	af854a3a-2127-422b-91ae-364da2661108
26	http://marc.info/?l=oss-security&m=125553728512853&w=2	af854a3a-2127-422b-91ae-364da2661108
27	http://marc.info/?l=oss-security&m=125561979001460&w=2	af854a3a-2127-422b-91ae-364da2661108
28	http://secunia.com/advisories/37016	af854a3a-2127-422b-91ae-364da2661108
29	http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/	af854a3a-2127-422b-91ae-364da2661108
30	http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/	af854a3a-2127-422b-91ae-364da2661108
31	http://www.mandriva.com/security/advisories?name=MDVSA-2009:274	af854a3a-2127-422b-91ae-364da2661108
32	http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php	af854a3a-2127-422b-91ae-364da2661108
33	http://www.securityfocus.com/bid/36658	af854a3a-2127-422b-91ae-364da2661108
34	http://www.vupen.com/english/advisories/2009/2899	af854a3a-2127-422b-91ae-364da2661108
35	https://bugzilla.redhat.com/show_bug.cgi?id=528769	af854a3a-2127-422b-91ae-364da2661108
36	https://exchange.xforce.ibmcloud.com/vulnerabilities/53741	af854a3a-2127-422b-91ae-364da2661108
37	https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html	af854a3a-2127-422b-91ae-364da2661108
38	https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html	af854a3a-2127-422b-91ae-364da2661108

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

phpMyAdmin の PDF スキーマジェネレータ機能における SQL インジェクションの脆弱性

Title	phpMyAdmin の PDF スキーマジェネレータ機能における SQL インジェクションの脆弱性
Summary	phpMyAdmin の PDF スキーマジェネレータ機能には、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、不特定のインターフェースパラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 13, 2009, midnight
Registration Date	Dec. 20, 2012, 7:28 p.m.
Last Update	Dec. 20, 2012, 7:28 p.m.

Affected System

The phpMyAdmin Project

phpMyAdmin 2.11.9.6 未満の 2.11.x および 3.2.2.1 未満の 3.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3697	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3697
National Vulnerability Database (NVD)
2	CVE-2009-3697	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3697

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
phpMyAdmin
1	PMASA-2009-6	http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-alpha:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-beta:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0-beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-beta1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1::::::