CVE-2006-2753

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-01 · updated 2026-06-16

Description

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysql_real_escape function is used to escape the input.

Affected products

Mysql: 4.1.0, 4.1.2, 4.1.3, 4.1.8, 4.1.10, 4.1.12 (+14)
MySQL Server: 4.1.1, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.9 (+16)

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=369735
http://docs.info.apple.com/article.html?artnum=305214
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://lists.mysql.com/announce/364
http://secunia.com/advisories/20365
http://secunia.com/advisories/20489
http://secunia.com/advisories/20531
http://secunia.com/advisories/20541
http://secunia.com/advisories/20562
http://secunia.com/advisories/20625
http://secunia.com/advisories/20712
http://secunia.com/advisories/24479

Get alerted when CVE-2006-2753 or the next vulnerability affects your stack