CVE-2006-0903

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-27 · updated 2026-06-16

Description

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Affected products

Mysql: 4.1.0, 4.1.3, 4.1.8, 4.1.10, 4.1.12, 4.1.13 (+10)
MySQL Server: 3.23, 3.23.0-alpha, 3.23.1, 3.23.2, 3.23.3, 3.23.4 (+111)

References

http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0653.html
http://bugs.mysql.com/bug.php?id=17667
http://rst.void.ru/papers/advisory39.txt
http://secunia.com/advisories/19034
http://secunia.com/advisories/19502
http://secunia.com/advisories/19814
http://secunia.com/advisories/20241
http://secunia.com/advisories/20253
http://secunia.com/advisories/20333
http://secunia.com/advisories/20625
http://secunia.com/advisories/30351
http://securitytracker.com/id?1015693

Get alerted when CVE-2006-0903 or the next vulnerability affects your stack