Description
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | mysql-dfsg-5.0 | 5.0.51a-24+lenny1 | DSA-1783-1 |
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch10 | DSA-1783-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.77-3.el5 | RHSA-2009:1289 |
| RHEL 4 | mysql +3 | 4.1.22-2.el4_8.3 | RHSA-2010:0110 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.13-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.13-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.84-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.012-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.609-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.10-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | php-pear | 1:1.8.1-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.14-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.510-1jpp.el5s2 | RHSA-2009:1461 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MySQL 5 - Command Line Client HTML Special Characters HTML Injection EDB-32445 · remote · Sep 30, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2009:1289 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0110 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1783-1 mysql-dfsg-5.0 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1461 Red Hat Security Advisory: Red Hat Application Stack v2.4 security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 20081029 Re: MySQL command-line client HTML injection vulnerability mailing-list
- MDVSA-2009:094 vendor-advisory
- USN-1397-1 vendor-advisory
- mysql-commandline-xss(45590) vdb-entry
- oval:org.mitre.oval:def:11456 vdb-entry signature
- 20081008 Re: MySQL command-line client HTML injection vulnerability mailing-list
- 38517 third-party-advisory
- DSA-1783 vendor-advisory
- http://bugs.mysql.com/bug.php?id=27884
- USN-897-1 vendor-advisory
- RHSA-2009:1289 vendor-advisory
- 32072 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- 20080930 MySQL command-line client HTML injection vulnerability mailing-list
- http://support.apple.com/kb/HT4077
- RHSA-2010:0110 vendor-advisory
- http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability
- 20081004 RE: RE: MySQL command-line client HTML injection vulnerability mailing-list
- 4357 third-party-advisory
- 34907 third-party-advisory
- 20080930 RE: MySQL command-line client HTML injection vulnerability mailing-list
- 36566 third-party-advisory
- 31486 vdb-entry