CVE-2006-2753

2006-06-0117:02:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2006-2753

mysql

sql injection

vulnerability

nvd

multibyte encodings

character sets

mysql_real_escape

7.8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.3%

JSON

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysql_real_escape function is used to escape the input.

CPENameOperatorVersion
mysql:mysqlmysqleq5.0.5
mysql:mysqlmysqleq5.0.10
mysql:mysqlmysqleq5.0.0
mysql:mysqlmysqleq5.0.15
mysql:mysqlmysqleq5.0.17
mysql:mysqlmysqleq4.1.13
mysql:mysqlmysqleq5.0.3
mysql:mysqlmysqleq4.1.15
mysql:mysqlmysqleq4.1.8
mysql:mysqlmysqleq4.1.14

CPE	Name	Operator	Version
mysql:mysql	mysql	eq	5.0.5
mysql:mysql	mysql	eq	5.0.10
mysql:mysql	mysql	eq	5.0.0
mysql:mysql	mysql	eq	5.0.15
mysql:mysql	mysql	eq	5.0.17
mysql:mysql	mysql	eq	4.1.13
mysql:mysql	mysql	eq	5.0.3
mysql:mysql	mysql	eq	4.1.15
mysql:mysql	mysql	eq	4.1.8
mysql:mysql	mysql	eq	4.1.14