The command injection vulnerabilities into SQL injections usually occur because the DBMS has a stored procedure or an allowed native option, which interacts directly with the OS. For example, xp_cmdshell on SQL Server, or a specially stored procedure developed in Java for Oracle.
In some cases, it is also possible that the application stores the database strings that are extracted by a query and executed; so, if we can update the database, we could inject a command into the server. However, as I mentioned, this is not a common case.
Once we have detected a vulnerability related to command injection, we can use Burp Suite to exploit it. For example, let's examine the following request from an application:
This request was ...
