I'm using the next stored procedure
sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection?
In the configuration of the
Database Mail Profile and Account
We use Anonymous Authentication and we have a default profile to send emails.