CVE-2012-5613 Privilege escalation in n/a
Authenticated users with FILE privilege can escalate privileges by creating files as administrator, requiring non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-5613?
CVE-2012-5613 is a medium-severity vulnerability in Mariadb Mariadb, published on 3 Dec 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.
Weakness: CWE-16
Which versions are affected by CVE-2012-5613?
It affects 2 products.
Products include Mariadb Mariadb, Oracle Mysql.
How do I fix CVE-2012-5613?
No fix has been published for CVE-2012-5613 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-5613 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-5613 exists.
Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries and 2 proofs of concept on GitHub.
Other vulnerabilities in Mariadb Mariadb
- CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
- CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
- CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
- CVE-2023-26785 Code injection in n/a
Sources
Also known as GHSA-cvqp-6rwh-x2fj.