They would not catch it, it requires combining multiple vulns.

I just meant the SQLi (which is the basis of the chain), not the full chain.