MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of t

Summary

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Timeline

1. Aug 17, 2006Public exploit on Exploit-DB

   EDB-28398

2. Aug 18, 2006, 7:55 PM UTCCVE published
3. Aug 7, 2024, 6:57 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 17