MySQL Privilege Escalation via COM_CHANGE_USER Command

CVE-2002-1374

Summary

The COM_CHANGE_USER command in certain MySQL versions is susceptible to exploitation through brute force methods. Attackers can manipulate the command using a one-character password, which results in MySQL only verifying the first character of the real password. This flaw may allow unauthorized users to gain elevated privileges, posing a serious security risk for database operations.

References