Evil-DB LogoEvil-DB
← All CVEs

CVE-2005-0709

medium · 4.6

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

4.6
CVSS
18.4%
EPSS (exploit prob.)
97th
EPSS percentile
2005-05-02
Published

AV:L/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

VendorProductAffected versions
mysqlmysql4.1.0
mysqlmysql4.1.3
mysqlmysql4.1.10
oraclemysql3.23.49
oraclemysql4.0.0
oraclemysql4.0.1
oraclemysql4.0.2
oraclemysql4.0.3
oraclemysql4.0.4
oraclemysql4.0.5
oraclemysql4.0.5a
oraclemysql4.0.6
oraclemysql4.0.7
oraclemysql4.0.7
oraclemysql4.0.8
oraclemysql4.0.8
oraclemysql4.0.9
oraclemysql4.0.9
oraclemysql4.0.10
oraclemysql4.0.11
oraclemysql4.0.11
oraclemysql4.0.12
oraclemysql4.0.13
oraclemysql4.0.14
oraclemysql4.0.15
oraclemysql4.0.18
oraclemysql4.0.20
oraclemysql4.0.21
oraclemysql4.0.23
oraclemysql4.1.0
oraclemysql4.1.2
oraclemysql4.1.3
oraclemysql4.1.4
oraclemysql4.1.5

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2005-0709