Back to list
MySQL command-line client HTML injection vulnerability
Sep 30 2008 08:29AM
Thomas Henlich (thomas henlich de)
RE: MySQL command-line client HTML injection vulnerability
Sep 30 2008 10:59PM
Quark IT - Hilton Travis (Hilton QuarkIT com au)
This bug was fixed in a MySQL release dated 01 May 2008. It is now 01
Oct 2008 - 5 months after the bug was released. So why exactly is this
news? Did I miss something here?
Hilton Travis Phone: +61 (0)7 3105 9101
(Brisbane, Australia) Phone: +61 (0)419 792 394
Manager, Quark IT http://www.quarkit.com.au
Quark Group http://www.quarkgroup.com.au
Microsoft SBSC PAL (Australia) http://www.sbscpal.com/
War doesn't determine who is right. War determines who is left.
This document and any attachments are for the intended recipient
only. It may contain confidential, privileged or copyright
material which must not be disclosed or distributed.
Quark Group Pty. Ltd.
T/A Quark Automation, Quark AudioVisual, Quark IT
> -----Original Message-----
> From: Thomas Henlich [mailto:thomas (at) henlich (dot) de [email concealed]]
> Sent: Tuesday, 30 September 2008 6:30 PM
> To: bugtraq (at) securityfocus (dot) com [email concealed]
> Subject: MySQL command-line client HTML injection vulnerability
> MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY
> Thomas Henlich <thomas (at) henlich (dot) de [email concealed]>
> The mysql command-line client does not quote HTML special characters
> like < in its output. This allows an attacker who is able to write
> into a table to hide or modify records in the output, and to inject
> scripting or cross-site request forgery attacks.
> HOW TO REPRODUCE
> $ mysql --html --execute "select '<a>'" ...
> <TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>
> AFFECTED VERSIONS
> Users are advised to install the available patch from
> If another resolution is not feasible, users are advised to modify
> SELECT statements to filter out the characters < and &:
> SELECT REPLACE(REPLACE(...,'&','&'),'<','<') AS ...;
> This workaround is incompatible with the described resolution and
> be reversed after installation of the patch.
> 2007-04-17 Opened bug on mysql.com
> 2008-05-01 Patch available
> The bug is filed on http://bugs.mysql.com/bug.php?id=27884.
> This advisory is available from
[ reply ]
Re: MySQL command-line client HTML injection vulnerability
Oct 08 2008 08:26PM
Michael Scheidell (scheidell secnap net)
Copyright 2010, SecurityFocus