Players gaining GM?

[jobo80]

I came on my server today to find that 3 players I had not given GM had full AZ gm powers. I asked all the other GMs and they had no idea what happened. I looked in the server logs and apparently one of the players found a way to "hack into the sql" and "give everyone gm". I do not have remote access on so I am confused as to how she would have done this. I banned the parties responsible but am confused on how she could have gained access enough to grant herself and 3 others GM powers. I looked in the time logs and nobody with AZ powers was on during her hour long destruction spree so I do not think that she could have been given these powers by another. How is this possible?

[Kiyoshi]

Check the script players use to create accounts, it may be set to automatically give them AZ commands upon login. That or an SQL injection that can only work when remote access is enabled.

[soul02]

may i ask whats ur realmlist?

[jobo80]

By how the person who gave out the accounts was talking I am pretty sure that she did not have the gm powers but rather discovered a way while online to obtain them. I do not think it is the script as other players that have created accounts do not have gm powers.

[Kiyoshi]

Try reconfiguring the mySQL database, you may have an SQL injection on your hands :S

[jobo80]

Any simple way to do it, I changed the pass but she somehow figured out how to get on and delete her ip ban and come back on.