CVE-2012-5613
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should...
- Published
- Dec 3, 2012
- Updated
- Aug 6, 2024
- Assigning CNA
- redhat
- Evidence observed
- Dec 2, 2012
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:S/C:P/I:P/A:PModerate · next 30 days
- Percentile
- 98.3%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.
Sources
modules/exploits/windows/mysql/mysql_mof.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/mysql/mysql_mof.platform)
- verification: check_declared($.exploit_windows/mysql/mysql_mof.check)
modules/exploits/windows/mysql/mysql_start_up.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/mysql/mysql_start_up.platform)
- verification: check_declared($.exploit_windows/mysql/mysql_start_up.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.