MySQL Connector/J Unicode Character String SQL Injection Vulnerability

Bugtraq ID:	35858
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 16 2009 12:00AM
Updated:	Jul 29 2009 06:15PM
Credit:	Sadao Hiratsuka
Vulnerable:	MySQL AB MySQL Connector/J 5.1.7
Not Vulnerable:	MySQL AB MySQL Connector/J 5.1.8

MySQL Connector/J Unicode Character String SQL Injection Vulnerability

MySQL Connector/J is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MySQL Connector/J 5.1.7 is affected; other versions may be vulnerable as well.

MySQL Connector/J Unicode Character String SQL Injection Vulnerability

Attackers can exploit this issue via a browser.

MySQL Connector/J Unicode Character String SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

MySQL Connector/J Unicode Character String SQL Injection Vulnerability

References:

• C.6.1.1. Changes in MySQL Connector/J 5.1.8 (16 July 2009) (MySQL AB)
  
• JVN#59748723 MySQL Connector/J vulnerable to SQL injection (JPCERT/CC)
  
• SQL Injection when using U+00A5 (Sadao Hiratsuka)