you don't necessarily need to be root.
Think of it this way, a lot of php based sites use mysql and contains hardcoded login information for the database(such as the credentials you have obtained). Even though the php script is likely being ran from an apache2 or httpd user, its still from localhost and it's allowed. So you don't need ssh in as root and modify privs. You could ssh in as any valid user that can run the mysql binary and then login to the database. Or if you can drop your own php script in the web directory, that php script could access the database for you.
Depending on the credentials theres the chance it's being reused as well. if the user is 'mysql' not so much, but the password could be valid for other logins. If its something like username = 'admin' and password = '!@DR#@!1HJ' then that means theres likely a user created admin account on the box, that could possibly being using that password. So instead of loggin into the database directly, you ssh in with those credentials and then access mysql.
As for leaving tracks, remember you're leaving waay more tracks then just the mysql logins, pretty much no matter what method you use. Thats why if you want to be covert youre gunna have to hunt down pretty much all the logs and clean them of dangerous entries, then hope that there isn't any isp related logs that could be time correlated to the attack. Theres reasons why its strongly recommended not to hack from home. Heck theres the chance that logs are emailed or backed up to a secondary server and your chances of cleaning them starts going down without breaking into even more boxes creating more data.
But back to the original issue, im positive that if you managed to get the mysql login information, that either those, or your method to obtain them can still be leveraged to accomplish your goal. Just gotta think hard and look harder.
