CVE-2006-7232

Advisory lineage Upstream: 0 Downstream: 1

Downstream

RHSA-2008:0364

Modified

Published: 26 Feb 2008, 18:00

Last modified:07 Aug 2024, 20:57

Vulnerability Summary

Overall Risk (default)

low

14/100

CVSS Score

3.5 LOW

v2.0 (nvd)

EPSS Score

2.12% LOW

2% probability +0.23%

KEV

Not listed

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

26 Feb 2008, 18:00

Published

Vulnerability first disclosed

07 Aug 2024, 20:57

Last Modified

Vulnerability information updated

Description

sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as originally demonstrated using ORDER BY.

CVSS Metrics

v2.0•LOW•Score: 3.5AV:N/AC:M/Au:S/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 2.12%• Percentile: 84%

Techniques & Countermeasures

CWE-89•Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected Systems

canonical•ubuntu_linux
6.06 | 6.10 | 7.04 | 7.10
mysql•mysql
≥ 5.0, < 5.0.32 | ≥ 5.1, < 5.1.14