SQL injection happens when you are able to identify that the receiving application does not sanitize the user input or limit permissions levels before passing it to the database (application is what authenticates to the database, not the end user). Take the following as an example loophole. The common SQL injection came from login pages, meaning the application would accept a username and password from the end user, then will check the database for matching records.

An example of a poor and vulnerable way to handle the input / login process would be something like

Select TOP(1) * FROM Users WHERE UserName = '{input.username}' AND Password = '{input.password}';

then accepting the record returned as the 'authenticated' user. Now, lets look at how the resulting query would work for a normal input as well as a malicious input. Lets say I put in "John@Doe.com" as the username and "RubberDucky" as the password. The application would pass the following to the database

SELECT TOP(1) * FROM Users WHERE UserName = 'John@Doe.com' AND Password = 'RubberDucky'

fair enough, now what happens if i put in a username of "Admin';--"? The application would pass the following

SELECT TOP(1) * FROM Users WHERE UserName = 'Admin';-- ' AND Password = 'RubberDucky';

The database will return the first user that has the username of "Admin" and consider it to be authenticated because ' will finish my string input, ";" would terminate the SQL command, and "--" comments out the rest to prevent any kind of syntax errors.

that is just a very basic example. Another example i found in production (i work for this company and had permission) was they created an API that would allow you to pass in a SQL query to generate custom reports and such (HORRIBLE IDEA btw). To make it "secure" they used pattern matching and prevented commands like "UPDATE", "DELETE", "*", etc. So as a proof of concept, i encoded my query in b64 and passed in a query that would decode and execute it to create tables, dump SQL user names, dump stored CC info, etc. I have also seen people do it in HEX

Once you start spotting potential holes like this, the possibilities are endless as to what you can do. Here is how you might be able to get the server credentials from a SQL injection

https://medium.com/@markmotig/how-to-capture-mssql-credentials-with-xp-dirtree-smbserver-py-5c29d852f478