We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in the database? Note that there is no tools in the application that generates the numbers.

  • Does the webapplication administrator have access to the source code of the application ?
    – HamZa
    Commented Jul 23, 2013 at 8:17
  • No, the administrator access here is granted by the creator of the application (He himself is also admin and wrote the code). The admin has full access to the app, he can add or remove users and navigate freely. Commented Jul 23, 2013 at 8:33
  • @HamZa Yes. The creator of the application is the person who wrote the code (and has access to it), he can give himself admin (=administrator) access in the application to add more users and navigate. Commented Jul 23, 2013 at 9:24

2 Answers 2


After reading your question several times, I think I understand what you mean. You're talking about an Administrator in the sense of Joomla! or WordPress administrator. Where an admin is a concept created by the application itself, and that admin has no access to the actual server.

In applications (Joomla!, WordPress, ModX, Concrete5, DotNetNuke, etc.), the administrator is able to install components and plugins that are basically server-side code that is able to read server files and eventually have as much database access as your application itself has. So if your application can store and read the sensitive data, then the application's admin can very likely read said data.

  • 1
    IIRC in WordPress an admin can inject PHP calls from the webinterface (plugins) and would therefore be able to access the database... Commented Jul 23, 2013 at 9:05
  • @LucasKauffman Thanks for the note. Corrected my answer.
    – Adi
    Commented Jul 23, 2013 at 9:08
  • @Adnan That is exactly what i mean. In this sense, confidential numbers must be masked inside the database which might lead to data integrity violation? Commented Jul 23, 2013 at 9:22
  • @OptimusPrime Well, you may use whatever term you like you describe the situation. Bottom line is, that person can see all of your database.
    – Adi
    Commented Jul 23, 2013 at 9:27
  • I downvoted this answer for the following reason: whatever access the user has in the application do not matter. What matters is what access the database login used by the application to access the data: if that login has access to the confidential fields, then the application admin will have access to them.
    – Stephane
    Commented Jul 23, 2013 at 9:43

If the administrator has access to the application or files containing connection strings used by the application, then technically he could be able to use these credentials (or write custom code providing he can modify the code of the application) and access all information stored within the application or database.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .