You can get a password hash from other sources besides a full DB dump. SQL injection, poorly generated tokens in URLs or cookies, etc.<p><i>If you&#x27;re able to perform SQL injection against the DB, would you not be able to change the password in order to gain access to the system, or grant admin privileges to your own account</i><p>Often it&#x27;s easier to do an injection against a SELECT, just forcing it to read an extra field, particularly now with ORMs that won&#x27;t pass straight SQL through.