1. This program is possibly vulnerable to SQL injection attacks, which lead to the database information leakage without authorization, such as user name and password, users information disclose. Furthermore, attacker can even control the whole operating system.
Solutions
1. Code examination. Filter the user input and URL by identifying sensitive characters(e.g. and, or, select).
2. Modify the Database access rights, and try to avoid access of DB through DBA.
3. Modify the access rights to data dictionary to disable the rights of normal (non-privileged) DB users.
4. Deploy application intrusion detection or firewall systems.
