Which of the following is possible in some SQL injection vulnerabilities on certain types of databases that affects the underlying server OS?

Database structure retrieval through SQL injection - by querying system tables such as information_schema on MySQL, PostgreSQL, or MSSQL - is a reliable capability that exposes the full database schema to the attacker. This structural knowledge enables subsequent data extraction, lateral movement within the database server, and can reveal OS-level artifacts such as file paths and version strings embedded in server metadata.

Shell command execution (such as via xp_cmdshell in MSSQL) requires specific database configurations and elevated database permissions that are not present in most default installations, making it less universally achievable than schema retrieval.

Data manipulation via DML statements (INSERT, UPDATE, DELETE) requires write permissions on targeted tables and does not directly interact with or expose information about the underlying server OS.

Data query capabilities (basic SELECT statements) represent the minimum baseline of any successful SQL injection and do not specifically distinguish the OS-level interaction potential that characterizes more advanced exploitation paths.