研究者披露 SQL Server Management Studio 中 SQL Copilot 的提权路径
安全研究者 Johann Rehberger 公开了对 Microsoft SQL Server Management Studio 中 AI 数据库助手 SQL Copilot 的研究，发现其中存在严重的提权路径，可从 SELECT 权限提升至 SYSADMIN。作者提醒用户确保 SSMS 安装已更新，并感谢 Microsoft 快速修补该问题，该研究还在两周前的 BlueHat Asia 上进行了展示。作者提到数据库 CONSTITUTION.md 这一概念，完整技术细节与视频演示见其博客文章。
From SELECT to SYSADMIN 🔥
Happy to share my research on the Microsoft's AI database assistant in SQL Server Management Studio, aka SQL Copilot.
This led to discovery of critical elevation paths. Make sure your SSMS installations are up to date.
Thanks to Microsoft for patching quickly and selecting this research to be presented at BlueHat Asia two weeks ago. 🙏
Have you heard of database CONSTITUTION.md before? 🤔
If not, read on and check out the blog for the full technical details and video demos.
🔽 🔽 🔽
https://embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-asia/