Description

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Remediation

References

CVE-2006-4227

Related Vulnerabilities

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-2213)

WordPress Plugin wpDataTables-WordPress Data Table, Dynamic Tables & Table Charts Multiple Vulnerabilities (2.0.11)

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler Security Bypass (6.9.11)

WordPress Plugin Facebook for WordPress PHP Object Injection (2.2.2)

Oracle Database Server CVE-2004-2345 Vulnerability (CVE-2004-2345)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2006-4227