Perhaps, but it would then depend on user privileges set in the database. If the application is accessing the DB as root or as a user with full admin privileges

Perhaps, but it would then depend on user privileges set in the database. If the application is accessing the DB as root or as a user with full admin privileges, then yes, I would say that would be a "game over" situation. On the other hand, if the DB user that is being used in the injection attack has read access to a limited set of tables, the damage may be much less severe. > and swap out the hash of the privileged user. True, if the initialization vectors of the hash are the same for admin and regular user accounts (for example, using the same salt for admin and normal users). You would also need write access to the DB via your injection attack.