SQL injection in mysql - CVE-2009-5026
Published: August 17, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43713
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-5026
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Affected software
mysql
SUSE Linux
SUSE Linux
How to mitigate CVE-2009-5026
Install update from vendor's website.
Links to Public Exploits and PoC-codes
External References
- http://bugs.mysql.com/bug.php?id=49124
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
- http://seclists.org/oss-sec/2011/q4/101
- http://secunia.com/advisories/49179
- https://bugzilla.redhat.com/show_bug.cgi?id=640177