Many services offered on the Internet such as email, sftp, and online games can do authentication against relational databases. The PAM module for Postgres is one example as it had an SQL injection vulnerability.
While it is not common to do logging to a database, this may be useful in some situation. The database appender of the Java logging framework log4j did not do any input escaping in the really early versions of log4j.
Those two cases above are rather easily spotted in an audit. The most interesting case, however, from my point of view is the following:
Given an application for employees that has been in use for decades. When the software was developed a long time ago, security was not an issue (for example because the employees could do far greater damage by entering wrong numbers or because it was done using tight permissions on the database level).
You know those ugly old applications nobody knows how they work and nobody wants to touch. If the risk of employees doing evil things is accepted, this works fine.
Fast forward: Internet is cool. Customers should enter their data in an web application themselves. The internet application is properly audited. It might even use a shadow database.
But in the end the data entered by untrusted people is now processed using the old application. If such data is saved back to the database or used in query the injected SQL statements are executed with the database permissions of the employee. (Sorry, no reference but I have seen that may too often in the real world. Sometimes this is not discovered until a customer has a name which includes a ').