| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <48E1E372.7050207@henlich.de> Date: Tue, 30 Sep 2008 10:29:38 +0200 From: Thomas Henlich <thomas@...lich.de> To: bugtraq@...urityfocus.com Subject: MySQL command-line client HTML injection vulnerability MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY Thomas Henlich <thomas@...lich.de> DESCRIPTION The mysql command-line client does not quote HTML special characters like < in its output. This allows an attacker who is able to write data into a table to hide or modify records in the output, and to inject potentially dangerous code, e. g. Javascript to perform cross-site scripting or cross-site request forgery attacks. HOW TO REPRODUCE $ mysql --html --execute "select '<a>'" ... <TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE> AFFECTED VERSIONS All. RESOLUTION Users are advised to install the available patch from http://bugs.mysql.com/bug.php?id=27884. WORKAROUND If another resolution is not feasible, users are advised to modify their SELECT statements to filter out the characters < and &: SELECT REPLACE(REPLACE(...,'&','&'),'<','<') AS ...; This workaround is incompatible with the described resolution and should be reversed after installation of the patch. TIMELINE 2007-04-17 Opened bug on mysql.com 2008-05-01 Patch available RESOURCES The bug is filed on http://bugs.mysql.com/bug.php?id=27884. This advisory is available from http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability.
Powered by blists - more mailing lists