Say I have a web app that is connecting to a database as an unprivleged user.
This database contains one client's data (all of it, and only that client's data). Also assume that the client is
reasonablyclueful and wants to do data mining above and beyond what I present through a web interface.
What damage could they do if given the ability to type in sql queries and execute them?
Obviously they could hose their own data. They could also do expensive joins.
Can they connect to another database? Can they interact at all with the file system?
thanks
eric
