📄 Description (English)
MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts.
🤖 AI Executive Summary
CVE-2021-47761 is a local privilege escalation vulnerability in MilleGPG5 5.7.2 that allows authenticated users to replace MariaDB executable files with malicious binaries, resulting in system-level code execution upon restart. With a CVSS score of 7.8, this vulnerability poses significant risk to organizations running MariaDB with improper file permissions. No public exploit is currently available, but a patch has been released.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 27, 2026 17:17
🇸🇦 Saudi Arabia Impact Assessment
Saudi banking institutions (SAMA-regulated) and government agencies using MariaDB for critical databases face elevated risk of system compromise. Financial services, healthcare providers (MOH), and energy sector organizations (ARAMCO subsidiaries) relying on MariaDB are particularly vulnerable. Telecommunications providers (STC, Mobily) managing customer databases could experience data breaches. The vulnerability requires local access, limiting exposure but enabling insider threats and lateral movement post-compromise.
🏢 Affected Saudi Sectors
Banking and Financial Services
Government and Public Administration
Healthcare
Energy and Utilities
Telecommunications
Education
Retail and E-commerce
🎯 MITRE ATT&CK Techniques
T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt
T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1543.003 - Create or Modify System Process: Windows Service
T1574.008 - Hijack Execution Flow: DLL Search Order Hijacking
T1036.005 - Masquerading: Match Legitimate Name or Location
T1078.001 - Valid Accounts: Local Accounts
⚖️ Saudi Risk Score (AI)
7.2
/ 10.0
🔧 Remediation Steps (English)
1. IMMEDIATE ACTIONS:
- Identify all systems running MilleGPG5 5.7.2 and MariaDB installations
- Review file permissions on MariaDB bin directory (typically C:\Program Files\MariaDB\bin)
- Restrict write access to MariaDB executable directories to SYSTEM and administrators only
- Audit recent file modifications in MariaDB directories using Windows Event Logs
2. PATCHING GUIDANCE:
- Upgrade MilleGPG5 to version 5.7.3 or later immediately
- Apply latest MariaDB security patches
- Test patches in non-production environment first
- Schedule patching during maintenance windows with system restart
3. COMPENSATING CONTROLS:
- Implement strict file integrity monitoring (FIM) on MariaDB bin directories
- Enable Windows Audit Policy for object access on executable files
- Restrict local user account creation and privilege assignment
- Implement application whitelisting for mysqld.exe
- Monitor process execution logs for unauthorized mysqld.exe launches
4. DETECTION RULES:
- Alert on file modifications in MariaDB bin directory
- Monitor for mysqld.exe execution with unexpected parent processes
- Track privilege escalation attempts by authenticated users
- Log and alert on changes to service executable paths in registry (HKLM\SYSTEM\CurrentControlSet\Services\MySQL*)
🔧 خطوات المعالجة (العربية)
1. الإجراءات الفورية:
- تحديد جميع الأنظمة التي تشغل MilleGPG5 5.7.2 و MariaDB
- مراجعة أذونات الملفات في دليل MariaDB bin
- تقييد الوصول للكتابة إلى أدلة ملفات MariaDB التنفيذية للنظام والمسؤولين فقط
- تدقيق التعديلات الأخيرة على الملفات باستخدام سجلات أحداث Windows
2. إرشادات التصحيح:
- ترقية MilleGPG5 إلى الإصدار 5.7.3 أو أحدث فوراً
- تطبيق أحدث تصحيحات أمان MariaDB
- اختبار التصحيحات في بيئة غير الإنتاج أولاً
- جدولة التصحيح خلال نوافذ الصيانة مع إعادة تشغيل النظام
3. الضوابط البديلة:
- تنفيذ مراقبة سلامة الملفات على أدلة MariaDB bin
- تفعيل سياسة تدقيق Windows لوصول الكائنات على الملفات التنفيذية
- تقييد إنشاء حسابات المستخدمين المحليين وتعيين الامتيازات
- تنفيذ قائمة بيضاء للتطبيقات لـ mysqld.exe
- مراقبة سجلات تنفيذ العمليات للإطلاقات غير المصرح بها
4. قواعد الكشف:
- تنبيهات على تعديلات الملفات في دليل MariaDB bin
- مراقبة تنفيذ mysqld.exe مع العمليات الأب غير المتوقعة
- تتبع محاولات تصعيد الامتيازات من قبل المستخدمين المصرحين
- تسجيل والتنبيه على التغييرات في مسارات الملفات التنفيذية للخدمة
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.6.1.1 - Access control policy
A.6.2.1 - User registration and access rights management
A.8.2.1 - Classification of information
A.8.2.3 - Handling of assets
A.12.4.1 - Event logging
A.12.4.3 - Protection of log information
🔵 SAMA CSF
ID.AM-2 - Software inventory
PR.AC-1 - Access control policy
PR.AC-4 - Access rights management
PR.PT-2 - Protective technology deployment
DE.CM-1 - System monitoring
DE.CM-3 - Activity monitoring
🟡 ISO 27001:2022
A.5.1.1 - Information security policies
A.6.1.1 - Access control policy
A.6.2.1 - User registration and access rights
A.8.2.3 - Handling of assets
A.12.4.1 - Event logging
A.12.4.3 - Protection of log information
A.14.2.1 - Secure development policy
🟣 PCI DSS v4.0.1
Requirement 1.1 - Firewall configuration standards
Requirement 2.1 - Default security parameters
Requirement 6.2 - Security patches
Requirement 7 - Restrict access to data
Requirement 10.2 - User access logging