Exploits from command line?

["Benjamin Livshits" <livshits () cs stanford edu>]

I've come upon some cases in large Web-base applications where the
errors such SQL injection and XSS are found in codes that are not
accessible by Web users. For instance, some applications include a few
sloppily written maintenance programs that are invoked from the command
line as well as Ant tasks that are supposed to be invoked by the
application administrator.

On the surface, these errors are probably pretty irrelevant, as an
attacker that has the permissions to run the application from the
command line is already in some sense in the system and can cause more
damage elsewhere. Is this the right assessment or are there situations
where the ability to perform SQL injections from the command line is in
fact somehow dangerous?

Thanks,
-Ben