Connection String Injection

From a login box to SSRF: a SQL connection string injection (and a file read that never needed auth)