In short : Possibly
On the one hand yes, this is a very real risk. With many ordinary application installations and database deployments, this vulnerability will indeed let you access the data.
On the other hand, no, an attacker can be blocked even at this stage. There are a number of techniques to mitigate this risk. For example:
Limited Privilege on OS. The arbitrary commands the attacker is executing on the application server must be executed with a particular user's credentials; if the user account has been configured in accordance with the Principle of Least Privilege, the user account may not have the authority to execute those arbitrary commands. Ideally, the user account will have permission to run the application but do absolutely nothing else.
Note: SELinux is a powerful technique for further limiting access to OS resources.
Limited Access to DB. Even if an attacker discovers the database credentials, they may not be much use. The database may be configured so these credentials are only valid for that application; so they cannot be used to connect to the database via any other tool. Or, the database may be configured so these credentials are only valid from this one client address; so all the attacker's db connections have to be tunneled through the database server, instead of from the attacker's own system.
There are no stored DB credentials. An application may be designed so that the user enters their credentials at login, for example, and these are used to access the DB. In this situation an attacker on the application server could not connect to the DB, no matter how much OS-level control they have.
DB credentials are stored elsewhere. An application may be configured so that it fetches the DB credentials from a separate service at runtime; this separate service may not allow connections except from the application itself.
Further note : these techniques are not exclusive, so combining them may be a powerful way of limiting an attacker's access. However, each one of these techniques require sophisticated non-default configuration, and a naive deployment is likely to miss out every single one.