Description

Acunetix detected the Database User Has Admin Privileges.
This issue has been confirmed by checking the connection privileges via an identified SQL injection vulnerability in the application.

Remediation

Create a database user with the least possible permissions for your application and connect to the database with that user. Always follow the principle of providing the least privileges for all users and applications.

References

Authorization and Permissions in SQL Server (ADO.NET)

Wikipedia - Principle of Least Privilege

How to Use MySQL GRANT to Grant Privileges to Account

Related Vulnerabilities

Oracle Reports rwservlet vulnerabilities

VMware Workspace ONE Access SSTI (CVE-2022-22954)

WordPress Plugin Statistics Remote Code Execution (1.8)

WordPress Plugin File Gallery Remote Code Execution (1.7.9)

WordPress Plugin Divi Builder PHP Code Injection (4.0.9)

Severity

High

Classification

CWE-267 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Insecure Admin Access Code Execution Privilege Escalation