I’m keep seeing this common mistake; The application schema was granted DBA privileges. Here is the problem, when a sql injection bug is found, then all DBA commands are available to the attacker.
The truth is, granting DBA to an application schema is the lazy way to get your application the privileges it requires to operate. Heck, I’m still seeing COTS applications that in the install guide say GRANT DBA TO
To fix this. Audit that app user to see what are it’s actually doing.
where username = ‘&USER’
group by obj_name,
Use the results of the query to derive what privileges are actually needed.