Yes, it can be done. You need to have the login and database information for the reomote database, and your snippet can check the user’s SESSION for permissions before doing anything; with the right permissions it will connect to the remote database and get whatever you want.
The parser class file even has a couple of functions for dealing with remote databases;
dbExtConnect($host, $user, $pass, $dbase)
getExtTableRows($host="", $user="", $pass="", $dbase="", $fields="*", $from="", $where="", $sort="", $dir="ASC", $limit="")
putExtTableRow($host="", $user="", $pass="", $dbase="", $fields="", $into="")
updExtTableRow($host="", $user="", $pass="", $dbase="", $fields="", $into="", $where="", $sort="", $dir="ASC", $limit="")
So basically all you need to do is check the user’s SESSION for permission, then do
$stuff_i_want = $modx->getExtTableRows(<host-name-or-address>, <remote username>, <remote password>, <remote database name>, <fields to get>, <table name>, <data for where>, <field to sort by>, <sort direction>, <number of rows to get>);
This returns an array all ready to use.