Grant_Priv exploits?

[Huu Da Tran]

This is unexpected to me...

I have a user with GRANT ALL PRIVILEGES ON *.* TO user@localhost ....

Now, I was not expected that this user is able to do:

UPDATE mysql.user SET Grant_Priv='Y' WHERE user='user';
FLUSH PRIVILEGES;


giving him the rights to create new GRANT.

How can I allow one user to manage his own databases, but without allowing him to add new users to the MySQL?

Regards,

H.

Huu Da
MySQL flirter