CVE-2012-2122 - MySQL Authentication Bypass

Proof of Concept (PoC) for CVE-2012-2122, a critical authentication bypass vulnerability affecting vulnerable MySQL and MariaDB servers.

Disclaimer

This project is intended for educational purposes, security research, and authorized penetration testing only. Do not use this software against systems you do not own or have explicit permission to test.

CVE-2012-2122 is an authentication bypass vulnerability discovered in MySQL's password verification logic.

Due to an integer casting/comparison bug, authentication can incorrectly succeed when an invalid password comparison evaluates as equal under certain conditions.

Rather than requiring knowledge of a valid password, an attacker can repeatedly attempt authentication using arbitrary passwords until the comparison bug is triggered.

The probability of success is approximately:

• 1 in 256 authentication attempts (0.39%)

Because of this relatively high probability, automated tools can usually bypass authentication within a few hundred login attempts.

Severity

Affected Versions

The vulnerability affects MySQL builds compiled with vulnerable compiler optimizations, including versions such as:

• MySQL 5.1.x
• MySQL 5.5.x
• Some MariaDB releases derived from vulnerable code

The issue primarily affected Linux distributions whose compiler behavior exposed the bug.

Not every installation of these versions is vulnerable.

Technical Details

During password verification, MySQL internally compares two hash values using the memcmp() function.

Under normal circumstances:

memcmp(hash1, hash2)

returns:

• 0 when equal
• non-zero when different

The vulnerability arose because the return value was stored in a signed integer and later converted in a way that allowed certain non-zero values to be interpreted as authentication success.

Simplified logic:

if (memcmp(hash1, hash2) == 0)
{
    // Login successful
}

Under vulnerable compiler behavior, specific return values from memcmp() could incorrectly satisfy the comparison.

As a result, incorrect passwords occasionally authenticated successfully.

Exploitation

An attacker only needs:

• Network access to the MySQL service
• A valid username

No password knowledge is required.

The attacker continuously submits login attempts using random passwords.

Eventually, one authentication succeeds because of the comparison bug.

Typical attack flow:

Attempt #1
    ↓
Authentication Failed

Attempt #57
    ↓
Authentication Failed

Attempt #141
    ↓
Authentication Failed

Attempt #237
    ↓
Authentication Successful

Average success occurs roughly once every 256 attempts.

Impact

Successful exploitation allows an attacker to:

• Authenticate without the correct password
• Access database contents
• Dump sensitive information
• Modify records
• Create or delete databases
• Escalate attacks against applications relying on MySQL

If administrative credentials are targeted, complete control of the database server may be obtained.

Detection

Indicators include:

• Large numbers of failed authentication attempts
• Rapid repeated logins from the same client
• Authentication succeeding after many failures
• Unusual database access patterns

Review MySQL authentication logs for excessive failed login activity.

Mitigation

The recommended mitigation is to upgrade to a patched release.

Additional defensive measures include:

• Restrict MySQL network exposure
• Limit access using firewalls
• Disable remote root logins
• Enforce least-privilege database accounts
• Monitor authentication logs for brute-force behavior
• Require VPN or internal network access where possible

References

• CVE-2012-2122
• Oracle MySQL Security Advisory
• MariaDB Security Advisory
• NVD (National Vulnerability Database)

---

## Example Usage

```bash
python3 exploit.py -ip <target>

Example:

python3 exploit.py -ip 192.168.1.100

Educational Purpose

This repository demonstrates how a subtle implementation bug in authentication logic can completely undermine password verification.

Although the vulnerability is over a decade old, it remains an important case study in:

• Secure software development
• Compiler-dependent behavior
• Authentication design
• Defensive programming
• Vulnerability research