peter bassill · operator
$ cve CVE-2005-0710 JSON

CVE-2005-0710 EXPLOIT

4.6
MEDIUM · CVSS 2.0 · EPSS 12.8% (pctl 96)

Patch early

A public exploit exists.

Description

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

Scoring

CVSS4.6 (MEDIUM, v2.0)
VectorAV:L/AC:L/Au:N/C:P/I:P/A:P
EPSS12.84% — more likely to be exploited than 96% of all CVEs
On CISA KEVno
Public exploityes
Published2005-05-02
Last modified2026-06-16

Affected (2)

VendorProduct
mysqlmysql
oraclemysql

Public exploits

SourceTitleDate
exploit-dbMySQL 4.x - CREATE FUNCTION mysql.func Table Arbitrary Library Injection2005-03-11

References

→ the Explorer  ·  watch your stack  ·  NVD