Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: va1446.htm

MySQL command-line client HTML injection vulnerability



MySQL command-line client HTML injection vulnerability
MySQL command-line client HTML injection vulnerability



MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY

Thomas Henlich  

DESCRIPTION

The mysql command-line client does not quote HTML special characters
like < in its output. This allows an attacker who is able to write data
into a table to hide or modify records in the output, and to inject
potentially dangerous code, e. g. Javascript to perform cross-site
scripting or cross-site request forgery attacks.

HOW TO REPRODUCE

$ mysql --html --execute "select ''" ...
AFFECTED VERSIONS All. RESOLUTION Users are advised to install the available patch from
http://bugs.mysql.com/bug.php?id=27884. WORKAROUND If another resolution is not feasible, users are advised to modify their SELECT statements to filter out the characters < and &: SELECT REPLACE(REPLACE(...,'&','&'),'<','<') AS ...; This workaround is incompatible with the described resolution and should be reversed after installation of the patch. TIMELINE 2007-04-17 Opened bug on mysql.com 2008-05-01 Patch available RESOURCES The bug is filed on http://bugs.mysql.com/bug.php?id=27884. This advisory is available from http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH