A public-app SQL injection can do more than read or change database records when Oracle is the backend. If the database account can create Java objects, attacker input can become code that the database compiles and runs on the host, which turns a form-field injection into OS-level compromise and credential theft.
Huntress documented that path in the wild. The attack used SQL injection against a public-facing Java/Tomcat app with an Oracle backend, then abused Oracle Java source handling to run the khunt post-exploitation toolkit. The endpoint hosting the database server showed registry hive copies, including SAM, SECURITY, and SYSTEM, which points to local credential dumping on the database host.
The practical change is where the incident response boundary sits. A case that starts as web-app SQLi can end with a compromised database server and stolen credentials on that server, so the database host itself has to be treated as part of the blast radius.