Rather than discussing whether or not this is legal(which, as has been pointed out, is beyond the scope of the Academia board and would depend on your local laws) let's discuss whether it was right or expected or not.
As mentioned by Nicholas, this, to some extent, depends on what you actually did. And, as I see it, this can be broken down into two categories.
If your work involved a database that is not manipulated by outsiders at any point then attempting to 'hack' it would be inappropriate. By this I mean if the database was secondary to the research you were presenting. An example might be a database of Face images used to train or test facial recognition algorithms. In such a case the database iteself is not the product or research being presented. It should be stable and reasonably secure(depending on the data it contains of course) but should not be the focus of 'testing' or inquiry in a defense.
However if your work involved a database that is manipulated by the user or researcher, particularly as a primary focus of the research/work then yes, 'hacking' this database is a reasonable thing for someone to try to do. If the work presented is a complete project, a proposed solution to a real world problem or in another situation where, yes, you are proposing that the system you created could be placed in the real world then attempting to 'hack' the system is not only reasonable but expected.
Let's take a moment, though, to discuss what 'hack' might mean in this situation. You mentioned a SQL Injection. For some folks 'hacking' brings to mind serious people wearing sunglasses indoors yelling "Hack the MAINFRAME!" as they use telephones, bits of wire and evil to do nasty things to computers. But, especially in this particular case, this 'hacking' would have been something as innocent as entering something into a data field. In the early days of speed cameras some clever motorists found a way to do such an attack. The cameras 'read' the license plates and automatically submitted speeding tickets. Clever if unethical motorists could put a sql string on their bumper, the camera would 'read' the string and, since the string wasn't properly sanitized, it would cause nasty things like deleting the entire database. SQL Injections are something that you should not be confused about what there are at graduation, that you are both unsure if that's what the instructor did AND indignant that they would do so would be a signal to me that you did need to re-defend your thesis. SQL (or just plain code) injection attacks are almost laughably easy to minimize, someone being able to 'hack' your database in the few minutes you described is a serious quality concern for a graduate in computer science perhaps especially in graduate level work(you are unclear about your level at the time of this issue).
Finally allow me to point out that all respectable software companies hire people whose job it is to attempt to hack into their own servers, software and, yes, databases. Additionally white hat hackers often attempt to hack software and environments and report it to said companies(black hat hackers will skip the reporting and go straight to exploiting.) No one wants to hear that their baby is ugly or that their code has a problem. I'm hearing a lot of indignation in your question related to that and I understand it but I'm going to respectfully advise you to both get over it and welcome such things - that is how you will become better at development.