The database account an application uses

• A

  Nothing extra, since the injection already runs arbitrary SQL

• B

  The injection can do anything the account can, including reading every table and dropping them

• C

  The attacker gains operating system access on the database server

• D

  The application becomes noticeably slower, since privileged accounts are audited far more heavily