NVD Vulnerability Detail
Search Exploit, PoC
CVE-2007-2692
Summary

The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

Summary

La función mysql_change_db en MySQL 5.0.x anterior a 5.0.40 y 5.1.x anterior a 5.1.18 no restaura los privilegios THD::db_access cuando regresa de rutinas almacenadas SQL SECURITY INVOKER, lo cual permite a usuarios autenticados remotamente obtener privilegios.

Publication Date May 16, 2007, 10:19 a.m.
Registration Date Jan. 29, 2021, 2:12 p.m.
Last Update April 23, 2026, 9:35 a.m.
CVSS2.0 : MEDIUM
Score 6.0
Vector AV:N/AC:M/Au:S/C:P/I:P/A:P
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC) 中
攻撃前の認証要否(Au) 単一
機密性への影響(C) 低
完全性への影響(I) 低
可用性への影響(A) 低
Get all privileges. いいえ
Get user privileges いいえ
Get other privileges はい
User operation required いいえ
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.3:beta:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.18:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.19:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.21:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.37:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List