NetSight
IP …
medium4.6Public exploit code

CVE-2005-0709

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

Affected products

VendorProductAffected versions
MysqlMysql
Versions 4.1.0, 4.1.3, 4.1.10
OracleMysql
Versions 3.23.49, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4

Weakness classification

CWE-94

References