A friend pointed out a sql injection vulnerability one an application I work with.
This search parameter:
'; exec xp_cmdshell 'dir'; --
Returned the message:
The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.
Because the search is run from an account that only has select permissions on a few tables and stored procedures.
I was wondering, if a malicious user happened to know the login information of an admin account for the sql server, would it be possible for them use the credentials get to root access to the machine through the cmd shell, or some other naughty work?