High · published December 3, 2025
⚡ Default SQL users with sysadmin roles? That’s the setup for disaster in NMIS/BioDose V22.02 and earlier! 🔥 Think of it as giving a delivery driver the keys to your entire warehouse instead of just the loading dock — they can access everything without checking in. In this case, a crafty attacker can exploit built-in stored procedures to gain complete control. An attacker armed with knowledge of this flaw could execute remote code, potentially leading to total system compromise. This means they could manipulate the database, delete data, or even install malicious software — it's an absolute nightmare just waiting to happen!
Think of it as giving a delivery driver the keys to your entire warehouse instead of just the loading dock — they can access everything without checking in. In this case, a crafty attacker can exploit built-in stored procedures to gain complete control. The vulnerability arises because the default SQL user account 'nmdbuser' and any accounts it creates have the sysadmin role by default, allowing for remote code execution through specific stored procedures.
An attacker armed with knowledge of this flaw could execute remote code, potentially leading to total system compromise. This means they could manipulate the database, delete data, or even install malicious software — it's an absolute nightmare just waiting to happen! Immediate action is crucial! First, change the default credentials for 'nmdbuser' and other accounts to something secure. Next, review permissions and limit sysadmin access only to accounts that absolutely need it. Finally, update to a more secure version of NMIS/BioDose as soon as possible. You've got this! Follow these steps and you’ll have your systems locked down tight! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mirion/biodose\/nmis | < 23.0 | 23.0 |