I can't decide whether it would be considered an SQL injection or a SSRF attack, actually. I'm leaning towards the latter. Or maybe even a reflected XSS?