Stored Procedure Abuse.

Exploiting privileged or insecure database stored procedures to execute arbitrary SQL, run OS commands, or escalate privileges from the database layer. It belongs to the Attacks & Threats category of cybersecurity.

Exploiting privileged or insecure database stored procedures to execute arbitrary SQL, run OS commands, or escalate privileges from the database layer.

Stored procedures encapsulate SQL on the database server and often run with elevated rights. Abuse occurs when an attacker can invoke dangerous built-ins (Microsoft SQL Server's xp_cmdshell, OPENROWSET, sp_OACreate; Oracle's UTL_FILE, DBMS_SCHEDULER; PostgreSQL's COPY ... PROGRAM), or when application-defined procedures concatenate parameters into dynamic SQL via EXEC/sp_executesql without parameter binding, reintroducing SQL injection inside trusted code. Outcomes include OS command execution as the DB service account, lateral movement via linked servers, data exfiltration through file system writes, and bypass of application-layer access controls. Hardening: drop or disable dangerous procedures, run with least privilege, use sp_executesql with typed parameters, and restrict who can EXECUTE.

Defences for Stored Procedure Abuse typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: xp_cmdshell abuse, Dangerous stored procedures.