SQL Injection Stacked DML Privilege Abuse - ATR-2026-01603 (00bed1bf-46ad-5779-be72-f12cc890e93d)
Detects stacked SQL injection where a secondary DML statement (UPDATE, INSERT, GRANT) is appended after a semicolon to modify data or escalate database privileges. Unlike destructive DDL (DROP/TRUNCATE), stacked DML abuse silently alters records—e.g., updating order status to bypass payment checks, inserting unauthorized admin users, or granting elevated SQL permissions. This targets agents that pass ORDER/FILTER inputs into SQL-executing tools without parameterization.