An attacker uses standard SQL injection methods to inject data into the
						command line for execution. This could be done directly through misuse of
						directives such as MSSQL_xp_cmdshell or indirectly through injection of data
						into the database that would be interpreted as shell commands. Sometime
						later, an unscrupulous backend application (or could be part of the
						functionality of the same application) fetches the injected data stored in
						the database and uses this data as command line arguments without performing
						proper validation. The malicious data escapes that data plane by spawning
						new commands to be executed on the host.