Affected: Best Practice Software Bp Premier

Best Practice Software Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations; in affected versions, the credential could not be changed without breaking the application. An attacker with network access to the database instance can use this credential to bypass application authentication and gain sysadmin privileges, allowing for arbitrary operating-system command execution (typically as SYSTEM). Exploitability depends entirely on the database's network exposure.