A SOC analyst reviewing web server logs for an internal application notices the following request against the login page: POST /login HTTP/1.1 with the parameter username=admin'--&password=x. Shortly after, the account 'admin' shows a successful authentication from the same source IP without a valid password. Which type of attack does this evidence most clearly indicate?