CVE-2012-5613

MySQL <5.5.19 & MariaDB <5.5.28a - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 7 public exploits for CVE-2012-5613. PoCs published by Metasploit, kingcope, Hood3dRob1n, including Metasploit module exploits/windows/mysql/mysql_mof.

AI-analyzed exploit summary This exploit abuses the MySQL FILE privilege on Windows to write a payload to the All Users Startup folder, achieving persistence. It requires valid MySQL credentials and targets Windows systems.

Description

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Exploits (7)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/35777

This exploit abuses the MySQL FILE privilege on Windows to write a payload to the All Users Startup folder, achieving persistence. It requires valid MySQL credentials and targets Windows systems.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle MySQL on Microsoft Windows
Auth required
Prerequisites: Valid MySQL credentials · FILE privilege on MySQL · Windows target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/23179

This Metasploit module exploits a file privilege misconfiguration in Oracle MySQL for Windows (CVE-2012-5613) to achieve arbitrary code execution as SYSTEM. It uploads a malicious MOF file and a payload executable to the target system via MySQL's DUMPFILE functionality.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle MySQL for Microsoft Windows
Auth required
Prerequisites: Valid MySQL credentials · Write access to MySQL's temporary directory and Windows system directories
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by kingcope · perllocallinux
https://www.exploit-db.com/exploits/23077

This exploit leverages a MySQL privilege escalation vulnerability (CVE-2012-5613) by creating a malicious trigger file to elevate privileges of a low-privileged user to admin. It requires the attacker to have FILE privileges to write the trigger file and crashes the MySQL server to force a reload of the configuration.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: MySQL 5.0.x, 5.1.x
Auth required
Prerequisites: MySQL user with FILE privileges · Ability to crash and restart MySQL server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 3 stars
by Hood3dRob1n · poc
https://github.com/Hood3dRob1n/MySQL-Fu.rb

This is a Ruby-based MySQL client tool that includes an exploit for CVE-2012-5613, a Linux MySQL privilege escalation vulnerability. It provides various MySQL interaction features, including file read/write, shell execution, and privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: MySQL (Linux)
Auth required
Prerequisites: Valid MySQL credentials · Network access to MySQL server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by w4fz5uck5 · poc
https://github.com/w4fz5uck5/UDFPwn-CVE-2012-5613

This is a Python script that automates the exploitation of CVE-2012-5613, a MySQL UDF (User-Defined Function) privilege escalation vulnerability. It compiles and loads a malicious UDF shared library to execute arbitrary code with root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: MySQL 4.x/5.0 (Linux)
Auth required
Prerequisites: MySQL credentials with CREATE/INSERT privileges · Write access to MySQL plugin directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by kingcope, sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_mof.rb

This Metasploit module exploits a file privilege misconfiguration in MySQL for Windows (CVE-2012-5613) by uploading a malicious MOF file to achieve SYSTEM-level code execution. It requires valid MySQL credentials and targets Windows systems prior to Vista.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Oracle MySQL for Microsoft Windows (pre-Vista)
Auth required
Prerequisites: Valid MySQL credentials · Write access to MySQL's temporary directory · Windows target (pre-Vista)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_start_up.rb

This Metasploit module exploits a file privilege misconfiguration in MySQL for Windows, allowing an authenticated attacker to write a malicious executable to the All Users Startup directory, achieving persistence and remote code execution upon user login.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle MySQL for Microsoft Windows
Auth required
Prerequisites: Valid MySQL credentials with FILE privilege · Network access to the MySQL server
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (6)

Core 6
Core References
Broken Link third-party-advisory
http://secunia.com/advisories/53372
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2012/12/02/3
Third Party Advisory vendor-advisory
http://security.gentoo.org/glsa/glsa-201308-06.xml
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2012/12/02/4
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
Exploit, Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2012/Dec/6

Scores

EPSS 0.8875
EPSS Percentile 99.5%

Details

CWE
CWE-16
Status published
Products (2)
mariadb/mariadb 5.5.28a
oracle/mysql 5.5.19
Published Dec 03, 2012
Tracked Since Feb 18, 2026