CVE-2008-4097

MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory, which are followed when tables are created in the future. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-2079.

• CWE-264

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlThird Party Advisory
• http://secunia.com/advisories/32759Vendor Advisory
• http://secunia.com/advisories/32769Broken Link, Not Applicable
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:094Broken Link
• http://www.openwall.com/lists/oss-security/2008/09/09/20Mailing List
• http://www.openwall.com/lists/oss-security/2008/09/16/3Mailing List
• http://www.ubuntu.com/usn/USN-671-1Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45648VDB Entry
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlThird Party Advisory
• http://secunia.com/advisories/32759Vendor Advisory
• http://secunia.com/advisories/32769Broken Link, Not Applicable
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:094Broken Link
• http://www.openwall.com/lists/oss-security/2008/09/09/20Mailing List
• http://www.openwall.com/lists/oss-security/2008/09/16/3Mailing List
• http://www.ubuntu.com/usn/USN-671-1Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45648VDB Entry

Published

Sep 18, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4091SQL injection vulnerability in index.php in Web Directory Sc…
• CVE-2008-4092SQL injection vulnerability in printfeature.php in myPHPNuke…
• CVE-2008-4093SQL injection vulnerability in memberstats.php in YourOwnBux…
• CVE-2008-4094Multiple SQL injection vulnerabilities in Ruby on Rails befo…
• CVE-2008-4095Multiple unspecified vulnerabilities in the Importer in Flip…
• CVE-2008-4096libraries/database_interface.lib.php in phpMyAdmin before 2.…
• CVE-2008-4098MySQL before 5.0.67 allows local users to bypass certain pri…
• CVE-2008-4099PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux do…
• CVE-2008-4100GNU adns 1.4 and earlier uses a fixed source port and sequen…
• CVE-2008-4101Vim 3.0 through 7.x before 7.2.010 does not properly escape …
• CVE-2008-4102Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak …
• CVE-2008-4103The mailto (aka com_mailto) component in Joomla! 1.5 before …