Hi Joel, can u submit your mysql `users` table.
Tuesday, May 18, 2004, 10:17:03 PM, you wrote: EJC> Could be. I didn't check, just was weird when I did it. EJC> -----Original Message----- EJC> From: Michael Gargiullo [mailto:[EMAIL PROTECTED] EJC> Sent: Tuesday, May 18, 2004 12:35 PM EJC> To: Esler, Joel - Contractor EJC> Cc: [EMAIL PROTECTED] EJC> Subject: Re: [Full-Disclosure] User bypass privs for Mysql?? EJC> On Tue, 2004-05-18 at 10:02, Esler, Joel - Contractor wrote: >> Not having any grant permissions. I went into the mysql/user table EJC> and >> edited the Grant from N to Y. Logged out and logged back in, and I EJC> had >> full privs including Grant. I shouldn't be able to do this... >> >> Joel EJC> but does your user have update permissions on either *.* or mysql.* EJC> etc... If as the root mysql user you give update permissions to the EJC> mysql.users table to a user, they can update themselves to what ever EJC> they want. EJC> _______________________________________________ EJC> Full-Disclosure - We believe in it. EJC> Charter: http://lists.netsys.com/full-disclosure-charter.html npguy npguy�websurfer.com.np _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
