CVE-2023-21980
HIGHMySQL < 5.7.41 and 8.0.32 - Authenticated Remote Code Execution via Client Programs
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-21980. PoCs published by ctkqiang.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2023-21980, targeting a MySQL client vulnerability via a malicious shared library loaded through a crafted server response. The exploit leverages UTF-16 encoding to bypass path validation and achieve arbitrary code execution.
Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Exploits (1)
The repository contains a functional exploit for CVE-2023-21980, targeting a MySQL client vulnerability via a malicious shared library loaded through a crafted server response. The exploit leverages UTF-16 encoding to bypass path validation and achieve arbitrary code execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H