You could manipulate query parameters to cause blind SQL injection. Blind SQL injection allowed a user to test names or values of database fields, or to download the values of database fields in small chunks and, as a result, use multiple queries to download (but not modify) important parts of Magento database.
Part of patch MAGENTO 2.0.1 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2