They don't need to know the password with db write access. In fact, depending on how the sessions are managed the attacker might just need read access to log i

They don't need to know the password with db write access. In fact, depending on how the sessions are managed the attacker might just need read access to log in without a password.