Describe SQL injection attack
SQL Injection is an attack that makes it possible to execute malicious SQL statements. These statements control a database server behind a web application.
Attackers can use SQL Injection vulnerabilities to bypass application security measures. They can go around authentication and authorization of a web page or web application and retrieve the content of the entire SQL database. They can also use SQL Injection to add, modify, and delete records in the database.
An SQL Injection vulnerability may affect any website or web application that uses an SQL database such as MySQL, Oracle, SQL Server, or others.
Criminals may use it to gain unauthorized access to, delete, or alter your sensitive data: customer information, personal data, trade secrets, intellectual property, and more.
SQL Injection attacks are among the oldest, most prevalent, and most dangerous web application vulnerabilities.
The OWASP organization (Open Web Application Security Project) lists injections in their OWASP Top 10 2017 document as the number one threat to web application security.
There's more
The Azure security center team has other playbooks you can look at to learn how vulnerabilities are exploited to trigger a virus attack and a DDoS attack.