CVE-2006-2753 — SQL Injection in Mysql

7 documents5 sources
Severity
7.5HIGHNVD
EPSS
6.1%
top 9.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MysqlOracle Mysql
Timeline
PublishedJun 1
Latest updateMay 1

Description

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysql_real_escape function is used to escape the input.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDmysql/mysql20 versions+19
▶NVDoracle/mysql22 versions+21

Patches

Patch: lists.mysql.com ↗Patch: lists.mysql.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-qp7f-p87q-h2h6: SQL injection vulnerability in MySQL 4↗2022-05-01
▶

📋Vendor Advisories

3
Ubuntu
MySQL vulnerability↗2006-06-17
▶
Ubuntu
PostgreSQL client vulnerabilities↗2006-06-09
▶
Red Hat
security flaw↗2006-05-31
▶

💬Community

2
Bugzilla
CVE-2006-2753 security flaw↗2018-08-16
▶
Bugzilla
CVE-2006-0903 Mysql multiple vulnerabilities (↗2006-04-07
▶
CVE-2006-2753 — SQL Injection in Mysql | cvebase