CVE-2006-4227

MySQL - Privilege Escalation via SUID Routine Argument Evaluation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4227. PoCs published by Michal Prokopiuk.

AI-analyzed exploit summary This exploit demonstrates a privilege escalation and security bypass vulnerability in MySQL 5.0.24 and prior. It leverages SUID routines to execute functions in a higher privilege context, allowing unauthorized access to restricted databases.

Description

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Michal Prokopiuk · textremotelinux
https://www.exploit-db.com/exploits/28398

This exploit demonstrates a privilege escalation and security bypass vulnerability in MySQL 5.0.24 and prior. It leverages SUID routines to execute functions in a higher privilege context, allowing unauthorized access to restricted databases.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: MySQL 5.0.24 and prior
Auth required
Prerequisites: Valid MySQL user credentials with privileges to execute SUID routines · Access to create databases and functions
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (16)

Core 16
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28442
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3306
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_23_sr.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-338-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21506
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19559
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22080
Various Sources x_refsource_confirm
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21770
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30351
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016709
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0083.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0364.html
Exploit x_refsource_confirm
http://bugs.mysql.com/bug.php?id=18630
Patch mailing-list x_refsource_mlist
http://lists.mysql.com/commits/7918

Scores

EPSS 0.1176
EPSS Percentile 95.6%

Details

CWE
CWE-20
Status published
Products (12)
mysql/mysql 5.0.1
mysql/mysql 5.0.2
mysql/mysql 5.0.3
mysql/mysql 5.0.4
mysql/mysql 5.0.20
mysql/mysql 5.0.22.1.0.1
mysql/mysql 5.0.24
mysql/mysql 5.1.5
oracle/mysql 5.0.0 alpha
oracle/mysql 5.1.6
... and 2 more
Published Aug 18, 2006
Tracked Since Feb 18, 2026