>> MySQL Multi-byte Encoding Processing Remote SQL Injection Vulnerability
Title : MySQL Multi-byte Encoding Processing Remote SQL Injection Vulnerability VUPEN ID : VUPEN/ADV-2006-2105 CVE ID : CVE-2006-2753
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2006-06-02
Technical Description
A vulnerability has been identified in MySQL, which could be exploited by remote attackers to bypass security restrictions and execute arbitrary SQL commands. This flaw is due to an error when operating in multi-byte character sets (e.g. SJIS, BIG5 and GBK) and parsing certain ASCII characters escaped with the "mysql_real_escape_string()" function, which could be exploited by malicious people to bypass standard string-escaping methods and conduct SQL injection attacks against a supposedly secure script.
