=== What is the potential impact?

In the context of a web application that is vulnerable to SQL injection: +
After discovering the injection, attackers inject data into the vulnerable
field to execute malicious commands in the affected databases.

Below are some real-world scenarios that illustrate some impacts of an attacker
exploiting the vulnerability.

==== Identity spoofing and data manipulation

A malicious database query enables privilege escalation or direct data leakage
from one or more databases. This threat is the most widespread impact.

==== Data deletion and denial of service

The malicious query makes it possible for the attacker to delete data in the
affected databases. +
This threat is particularly insidious if the attacked organization does not
maintain a disaster recovery plan (DRP).

==== Chaining DB injections with other vulnerabilities

Attackers who exploit SQL injections rely on other vulnerabilities to maximize
their profits. +
Most of the time, organizations overlook some defense in depth measures because
they assume attackers cannot reach certain points in the infrastructure. This
misbehavior can lead to multiple attacks with great impact:

* When secrets are stored unencrypted in databases: Secrets can be exfiltrated and lead to compromise of other components.
* If server-side OS and/or database permissions are misconfigured, injection can lead to remote code execution (RCE).
** See https://blog.sonarsource.com/exploiting-hibernate-injections/[our article on this topic]
