vendor:
MySQL
by:
bkbll
7.5
CVSS
HIGH
Remote Code Execution
CWE
Product Name: MySQL
Affected Version From: 3.23.x
Affected Version To: 4.0.x
Patch Exists: NO
Related CWE:
CPE: mysql
Platforms Tested:
2003
Mysql 3.23.x/4.0.x remote exploit
This is a proof of concept exploit for a remote code execution vulnerability in MySQL versions 3.23.x and 4.0.x. The exploit uses the jmp *eax technique. The exploit was discovered by bkbll (bkbll cnhonker.net, bkbll tom.com) on September 12, 2003. The exploit allows an attacker to execute arbitrary code on a vulnerable MySQL server. It is advised not to distribute this exploit.
Mitigation:
Upgrade to a non-vulnerable version of MySQL.