We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in the database? Note that there is no tools in the application that generates the numbers.
After reading your question several times, I think I understand what you mean. You're talking about an Administrator in the sense of Joomla! or WordPress administrator. Where an admin is a concept created by the application itself, and that admin has no access to the actual server.
In applications (Joomla!, WordPress, ModX, Concrete5, DotNetNuke, etc.), the administrator is able to install components and plugins that are basically server-side code that is able to read server files and eventually have as much database access as your application itself has. So if your application can store and read the sensitive data, then the application's admin can very likely read said data.
|show 2 more comments|
If the administrator has access to the application or files containing connection strings used by the application, then technically he could be able to use these credentials (or write custom code providing he can modify the code of the application) and access all information stored within the application or database.