Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2009-2446

Quick assessment

Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Oracle MySQL是美国甲骨文（Oracle）公司的一套开源的关系数据库管理系统。 Oracle MySQL的sql_parse.cc文件中的dispatch_command()函数存在格式化字符串错误漏洞。攻击者可通过提交特制的COM_CREATE_DB或COM_DROP_DB请求利用该漏洞导致受影响的服务崩溃。

AI Predicted 6.5 Difficulty: Easy EPSS 10.59% · P95

Public Exploits 1

ExploitDB · 1 EDB-33077 [dos]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2009-2446

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Oracle MySQL SQL_parse.cc 格式化字符串错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Oracle MySQL是美国甲骨文（Oracle）公司的一套开源的关系数据库管理系统。 Oracle MySQL的sql_parse.cc文件中的dispatch_command()函数存在格式化字符串错误漏洞。攻击者可通过提交特制的COM_CREATE_DB或COM_DROP_DB请求利用该漏洞导致受影响的服务崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2009-2446

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2009-2446

请登录查看更多情报信息。

Vendor Advisories for CVE-2009-2446 (13)

Mailing List Discussions for CVE-2009-2446 (2)

Other References for CVE-2009-2446 (2)

Same Patch Batch · n/a · 2009-07-13 · 17 CVEs total

CVE-2009-2445 Sun Java System Web Server .jsp文件信息泄露漏洞
CVE-2009-2447 esoftpro online_guestbook_pro 跨站脚本攻击漏洞
CVE-2009-2448 Esoftpro Online Guestbook Pro ogp_show.php跨站脚本攻击漏洞
CVE-2009-2449 ADbNewsSender 'path_to_lang'参数远程目录遍历漏洞
CVE-2009-2450 Tallemu Online Armor个人防火墙IOCTL请求本地权限提升漏洞
CVE-2009-2434 IBM AIX 'syscall' Unspecified 缓存区移除漏洞
CVE-2009-2435 IBM Lotus Sametime用户名枚举漏洞
CVE-2009-2436 PHP Online Dating Software MyPHPDating 'page.php' SQL注入漏洞
CVE-2009-2437 Rentventory index.php脚本跨站脚本攻击漏洞
CVE-2009-2438 ClanSphere index.php脚本跨站脚本攻击漏洞
CVE-2009-2439 Web Development House Alibaba Clone多个SQL注入漏洞
CVE-2009-2440 Jnmsolutions JNM Guestbook index.php跨站脚本攻击漏洞
CVE-2009-2441 Esoftpro Online Guestbook Pro ogp_show.php跨站脚本攻击漏洞
CVE-2009-2442 Linea21 脚本public/index.php 跨站脚本攻击漏洞
CVE-2009-2443 Siteframe 'phpinfo.php' 信息泄露漏洞
CVE-2009-2444 ADbNewsSender 脚本setup/index.php 远程目录遍历漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2009-2446

No comments yet

Leave a comment