Along similar lines, I once found a very simple class. It was an endpoint which executed a stored procedure. The name of the stored procedure was passed in as a

Along similar lines, I once found a very simple class. It was an endpoint which executed a stored procedure. The name of the stored procedure was passed in as a query string parameter. There was no validation being done. It also ran system stored procedures; if you're not familiar with that, think admin and housekeeping type functions on the database. We couldn't immediately disable or firewall it as it had embedded its roots deep, and a lot of things calling it didn't know they were calling it.