I've been doing software security since 1994, but spent 10 of those years as a dev, and so didn't do my first web pentest until '05. On my first ever web gig, I scored a login prompt with 'OR''=' SQLI in the password field. It's like the White Whale for me now; I haven't seen it again, but I know it's out there. Arrrrrhh.
I can understand and even respect a good pw SQL inject, but they MUST HAVE sat there with pins and needs, giddy, saying to themselves: "It CANT be THIS easy!".
I found exactly the same thing in the first week of my previous gig.
Your White Whale unfortunately pops it head up everywhere.
I was thinking the same thing--finally something my grandma and me could have hacked during some "grandma-grandson time".