Description

Acunetix detected the Database User Has Admin Privileges.
This issue has been confirmed by checking the connection privileges via an identified SQL injection vulnerability in the application.

Remediation

Create a database user with the least possible permissions for your application and connect to the database with that user. Always follow the principle of providing the least privileges for all users and applications.

References

Authorization and Permissions in SQL Server (ADO.NET)

Wikipedia - Principle of Least Privilege

How to Use MySQL GRANT to Grant Privileges to Account

Related Vulnerabilities

WordPress Plugin Secure File Manager Remote Code Execution (2.8.1)

ManageEngine Desktop Central Deserialization RCE (CVE-2020-10189)

WordPress Plugin wSecure Lite Remote Code Execution (2.3)

vBulletin Pre-Auth RCE Vulnerability

HTML Form found in redirect page

Severity

High

Classification

CWE-267 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Insecure Admin Access Code Execution Privilege Escalation