If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to read/modify/attack other tables in the database through SQL injection?
Yes, depending on the underlying database security a single SQL Injection attack can affect other tables in the same database and even tables in different databases or in very specific cases tables running on different database instances.
It is even possible to update/read from multiple tables at one time using a single database query. Since you tagged your question as mysql here is a MySQL query for updating multiple tables:
UPDATE Books, Orders SET Orders.Quantity=Orders.Quantity+2, Books.InStock=Books.InStock-2 WHERE Books.BookID=Orders.BookID AND Orders.OrderID = 1002;
Reading is as simple as using a JOIN:
SELECT t1.name, t2.otherColumn FROM Table1 as t1 LEFT JOIN Table2 as t2 ON t1.id = t2.id
Obviously the effectiveness of these queries will depend on the underlying table structure, but you can absolutely read from unintended/multiple tables using SQL Injection.
An example of when this would not be possible is if the tables in question all belong to different schemas, each with a specific account that can access. Example:
app1.ImportantTable app2.OtherTable app3.BigTable
If each of these schemas is configured to only allow a different user access then there can be no unintended access. So if there is a
App1User setup in the database that can only read/modify the
app1 schema, it will not be able to select data from tables in the
It completely depends on the permissions granted to the database user the application is using to access the database.
In the best case, no, the user will not have access to any data or tables that it does not need to perform the actions the application requires it to perform. (In the very best case, it has no direct access to any tables at all, but only permissions to execute pre-defined procedures that return specific, limited data.)
In the worse case, it can not only access other tables in the database belonging to other applications, but to other databases, and to the server the database engine is running on, and to the network that the server running the database engine is connected to.
Excessive permissions granted to the user an application uses to access a database, in other words, can be very, very dangerous. It's most important to ensure that database users are appropriately restricted to only the objects and data that they actually need to access in order to perform the functions required by the application, and no more.