MSSQL set up security??

In doing a forum update to a SQL version of the forum, I stumbled upon a security hole.

When you run the sql setup file on top of an installation it creates a new admin account with the widely distributed username and password. This means that if you do not delete the sql setup file, it can be run and give someone admin access to your forum. Those that have installed the username change MOD should be even more cautious as they will not notice the new admin user if the person changes the username.

My suggestion for closing the hole would be to have the setup file check to be sure the database is empty before adding the admin and guest accounts during set-up.

True, but you run it yourself with an upgrade in order to upgrade the stored procedures and add another admin and forget (or not know to) delete it.

Either way it should check to avoid adding another admin, it such an easy fix, it seems lax not to do it.

Edited by ljamal

You can shoot it to the mountain top, but that doesn't mean it won't be done. I always thought the idea behind building applications was to make them as idiot proof as possible. A simple SQL if clause would make this a unfactor, so why all the opposition?

Make something idiot proof, and they'll build a better idiot. Many don't read installation instructions. You just know they're not going to read post-installation instructions.