Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?