(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way I ask this is a little clumsy.)
I was catching up on out some infosec news a few days ago when I came across this item about a gray hat security researcher/hacker who was arrested earlier this month on charges related to breaking into the web site of a county elections body in Florida. From a technical standpoint, it appears that compromise occurred when this fellow used an SQL injection attack against a login database and managed to steal the plaintext (!) password of a county elections supervisor from it. He then used those credentials to login to the content management system of the website, and that was that.
After reading about this something odd struck me. I realized that there was a pretty fundamental point about the nature of these ultra-common SQL injection thefts from password databases that I really didn't/don't understand at all. That being: Why is it even possible to manipulate a login database to disclose password hashes (and/or usernames, salts, or any other authentication-related info) in the first place?
I can understand why SQL injection can work against databases in general; the archetypal common job of a database is to return user-readable information stored in it in response to a user query. But the job of a login credential database is very different. It does not actually require sending stored authentication information outside the database, but instead just providing an answer to the web server passing along the user-supplied credentials about whether they are valid or not. (Right?)
So why do we even use full-power database software and SQL queries to handle the pretty limited needs of username & password authentication at all?. Why aren't there limited-purpose database applications specifically aimed at just doing what a password database needs to do, vs. using general-purpose applications that leave lots of room for SQL injection to occur? What am I missing?