Sql injection on application box