NetSight
IP …
medium6.5Public exploit code

CVE-2006-4227

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Affected products

VendorProductAffected versions
MysqlMysql
Versions 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.20, 5.0.22.1.0.1
OracleMysql
Versions 5.0.0, 5.1.6, 5.1.9, 5.1.10

Weakness classification

CWE-20

References