sockaddrtochka.ru
Date: Sat Feb 25 2006 - 23:53:34 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

RST/GHC advisory#39
Product: MySQL
Version: <=5.0.18
URL: http://www.mysql.com/

[Summary]

An attacker has the opportunity to bypass query logging.

[Details]

In case the " log" parameter is On, server saves all database queries in file.
Attacker can use NULL symbol in query to bypass loggin.
All data after NULL symbol will cut off and attacker's queries won't be logged.

[Exploit]

mysql_connect(...);
mysql_query('/*'.chr(0).'*/ SELECT * FROM table');

[Author]

1dt.w0lf
RST/GHC
http://rst.void.ru
http://ghc.ru

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]