p.s.
The exploit also requires that the DB security is not using 'best practices'
(all data access through stored procedures, no rights to the base tables)
But if a developer/development team have left SQL injection vulnerabilities
in the front end, I somehow doubt they'll have got the DB security right.
