FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mysql -- command line client input validation vulnerability

Affected packages
5.1 < mysql-client < 5.1.28_1
5.0 < mysql-client < 5.0.67_1

Details

VuXML ID 4775c807-8f30-11dd-821f-001cc0377035
Discovery 2007-04-17
Entry 2008-10-01
Modified 2008-10-10

Thomas Henlich reports:

The mysql command-line client does not quote HTML special characters like < in its output. This allows an attacker who is able to write data into a table to hide or modify records in the output, and to inject potentially dangerous code, e. g. Javascript to perform cross-site scripting or cross-site request forgery attacks.

References

Bugtraq ID 31486
URL http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/