CVE-2002-0721: Microsoft SQL Server weak permissions on extended stored procedures

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows privilege escalation to administrator on a database server and has a very high EPSS score, though it is not in KEV and the record lacks modern exploit detail.

What it is

Microsoft SQL Server 7.0 and 2000 installs extended stored procedures tied to helper functions with weak permissions. Unprivileged users, and possibly remote attackers, can execute xp_execresultset, xp_printstatements, or xp_displayparamstmt with administrator privileges. This is a privilege escalation flaw in default installations of an affected database server.

Impact

An attacker gains the ability to run stored procedures with administrator privileges on the SQL Server instance, effectively escalating from an unprivileged database user to full control of the database service.

Attack surface

The flaw is reachable through the SQL Server interface, and the description states unprivileged users and possibly remote attackers can trigger it, so no special privileges are required; the record does not specify whether network exposure or authentication is mandatory beyond that.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.46307 (98.76th percentile), indicating a high modeled likelihood of exploitation; reference tags are limited to US Government Resource with no exploit tags.

What to do

• Apply the Microsoft security bulletin MS02-043 fix for SQL Server 7.0 and 2000.
• Restrict and audit permissions on the extended stored procedures xp_execresultset, xp_printstatements, and xp_displayparamstmt.
• Limit SQL Server network exposure and require strong authentication for database logins.
• Review database roles to ensure no unprivileged accounts retain execute rights on these procedures.

Detection

• Monitor SQL Server audit logs for execution of xp_execresultset, xp_printstatements, or xp_displayparamstmt by non-administrative logins.
• Alert on privilege changes or unexpected administrative actions originating from low-privileged database accounts.
• Baseline which accounts can execute extended stored procedures and flag deviations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.