One of the major problems in any organization is the oldest code hasn’t been tested against more newly discovered bugs. VB6, classic ASP, and even COBOL can be vulnerable to more modern flaws like SQL injection. As "Charles" writes on stack overflow,
“Non-parameterized dynamic statements are what you need to worry about…for example,
STRING "INSERT INTO TBL (a,b,c) VALUES (" X ", "Y ", "Z ")" INTO WSQLSTMT.
EXEC SQL PREPARE MYSTMT FROM :WSQLSTMT END-EXEC.
EXEC SQL EXECUTE MYSTMT END-EXEC. ”