Every CVE Search/ Get API key

CVE-2006-0903

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that...

4.6 MediumPublic exploitFix available

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Exploit likelihood

1.37%Down 1.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.6

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Record
CVE-2006-0903
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Record
CVE-2006-0903
Updated
2026-11-02
EUVDEUVD-2006-0907 No score

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Record
EUVD-2006-0907
Updated
2026-11-03
GitHub AdvisoriesGHSA-4qqq-9pg4-j3vh No score

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that...

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Record
GHSA-4qqq-9pg4-j3vh
Updated
2026-11-02
OSVBELL-CVE-2006-0903 4.6

CVE-2006-0903 does not affect BellSoft software

Record
BELL-CVE-2006-0903
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVopenSUSE-SU-2024:11038-1 No score

libmariadbd-devel-10.6.4-2.1 on GA media

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11038-1
Updated
2026-11-02
OSVSUSE-RU-2023:3956-1 No score

Recommended update for mariadb104

This update for mariadb104 fixes the following issues:

  • Implement version 10.4 of MariaDB (jsc#PED-2455):
    • It is possible to use more than one authentication plugin for each user account.
    • The root user account is being created with the ability to use two authentication plugins.
    • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
    • Is being supported for User Password Expiry, which is not active by default.
    • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
  • Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
  • MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
  • Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
  • Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
Record
SUSE-RU-2023:3956-1
Updated
2026-11-02
OSVSUSE-RU-2023:4991-1 No score

Recommended update for mariadb104

This update for mariadb104 fixes the following issues:

  • Implement version 10.4 of MariaDB (jsc#PED-2455):
    • It is possible to use more than one authentication plugin for each user account.
    • The root user account is being created with the ability to use two authentication plugins.
    • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
    • Is being supported for User Password Expiry, which is not active by default.
    • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
  • Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
  • MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
  • Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
  • Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
Record
SUSE-RU-2023:4991-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql
Debian:3.0
 before 3.23.49-8.15, plus listed versions
3.23.49-8.103.23.49-8.113.23.49-8.133.23.49-8.143.23.49-8.83.23.49-8.9
3.23.49-8.15
mysql-dfsg-4.1
Debian:3.1
 before 4.1.11a-4sarge3, plus listed versions
4.1.11a-44.1.11a-4sarge14.1.11a-4sarge2
4.1.11a-4sarge3
mysql-dfsg
Debian:3.1
 before 4.0.24-10sarge2, plus listed versions
4.0.24-104.0.24-10sarge1
4.0.24-10sarge2
mysql
Red Hat:enterprise_linux:4::as
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-bench
Red Hat:enterprise_linux:4::as
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-devel
Red Hat:enterprise_linux:4::as
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-server
Red Hat:enterprise_linux:4::as
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql
Red Hat:enterprise_linux:4::desktop
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-bench
Red Hat:enterprise_linux:4::desktop
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
Show 52 moreShow less
Affected packages
PackageAffectedFixed
mysql-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-devel
Red Hat:enterprise_linux:4::desktop
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-server
Red Hat:enterprise_linux:4::desktop
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql
Red Hat:enterprise_linux:4::es
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-bench
Red Hat:enterprise_linux:4::es
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-devel
Red Hat:enterprise_linux:4::es
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-server
Red Hat:enterprise_linux:4::es
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql
Red Hat:enterprise_linux:4::ws
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-bench
Red Hat:enterprise_linux:4::ws
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-devel
Red Hat:enterprise_linux:4::ws
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql-server
Red Hat:enterprise_linux:4::ws
 before 0:4.1.20-1.RHEL4.1
0:4.1.20-1.RHEL4.1
mysql
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql-bench
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql-debuginfo
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql-devel
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql-server
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql-test
Red Hat:rhel_application_stack:1
 before 0:5.0.30-1.el4s1.1
0:5.0.30-1.el4s1.1
mysql
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-bench
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-server
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-test
Red Hat:enterprise_linux:5::client_workstation
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql
Red Hat:enterprise_linux:5::client
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-bench
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-devel
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-server
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mysql-test
Red Hat:enterprise_linux:5::server
 before 0:5.0.45-7.el5
0:5.0.45-7.el5
mariadb104
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
mariadb104
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
mariadb104
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
lz4
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
lz4
SUSE:Linux Enterprise Server 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Server 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Server 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Server 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
lz4
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
mariadb
openSUSE:Tumbleweed
 before 10.6.4-2.1
10.6.4-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMySQL 5.0.18 - Query Logging Bypass2006-02-27

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-0903 is a medium vulnerability (CVSS 4.6) in Mysql, published February 27, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in mysql 3.23.49-8.15.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 330 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open