lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1084898081.2035.71.camel@maverick.home.gargiullo.com>
From: mgargiullo at warpdrive.net (Michael Gargiullo)
Subject: User bypass privs for Mysql??

On Tue, 2004-05-18 at 10:02, Esler, Joel - Contractor wrote:
> Not having any grant permissions.  I went into the mysql/user table and
> edited the Grant from N to Y.  Logged out and logged back in, and I had
> full privs including Grant.  I shouldn't be able to do this...
> 
> Joel

but does your user have update permissions on either *.* or mysql.*
etc...   If as the root mysql user you give update permissions to the
mysql.users table to a user, they can update themselves to what ever
they want.



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ