FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mysql -- command line client input validation vulnerability

Affected packages
5.1	<	mysql-client	<	5.1.28_1
5.0	<	mysql-client	<	5.0.67_1

Details

VuXML ID	4775c807-8f30-11dd-821f-001cc0377035
Discovery	2007-04-17
Entry	2008-10-01
Modified	2008-10-10

Thomas Henlich reports:

The mysql command-line client does not quote HTML special characters like < in its output. This allows an attacker who is able to write data into a table to hide or modify records in the output, and to inject potentially dangerous code, e. g. Javascript to perform cross-site scripting or cross-site request forgery attacks.

[source]

References

Bugtraq ID	31486
URL	http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/