Description
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress WP-Advanced-Search Cross-Site Request Forgery (3.3.8)
WordPress Plugin Advanced Dynamic Pricing for WooCommerce Multiple Vulnerabilities (4.1.5)
MySQL CVE-2022-21363 Vulnerability (CVE-2022-21363)
CrushFTP Server Improper Validation of Integrity Check Value Vulnerability (CVE-2023-48795)
WordPress Plugin Custom Banners Cross-Site Request Forgery (3.2.2)