CVE-2021-2471 PoC — Oracle MySQL 输入验证错误漏洞

Source

https://github.com/SecCoder-Security-Lab/jdbc-sqlxml-xxe

Associated Vulnerability

Title: Oracle MySQL 输入验证错误漏洞 (CVE-2021-2471)
Description:Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

Description

h2-jdbc(https://github.com/h2database/h2database/issues/3195) & mysql-jdbc(CVE-2021-2471) SQLXML XXE vulnerability reproduction.

Readme

# jdbc-sqlxml-xxe
- h2-jdbc (CVE-2021-23463) (https://github.com/h2database/h2database/issues/3195) SQLXML XXE vulnerability reproduction. 
- mysql-jdbc (CVE-2021-2471) SQLXML XXE vulnerability reproduction.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →