Deloitte interview question

What will be the next step after finding an SQL Injection?