Another interesting question where I can cite that awesome quote I've found on the internet a few years ago regarding the creation of multiplayer games:
The client is in the hands of the enemy.
Whereas the enemy is the player trying to cheat or "hack".
Overall, there's no 100% perfect way to avoid hacking, cheating or botting.
One of the easiest way to avoid such issues is - as said in the quote - to never trust the client.
Neverwinter Nights 2 offers a perfect example for this. It had horrible net code. I helped running a roleplay server a few years ago and it was really, really hard to do so right after the first expansion has been released. What happened?
Account creation in Neverwinter Nights 2 has been (not sure it's been changed) the perfect example of how not to do it. Just to note, the game offers two different modes of multiplayer gameplay: Either characters saved on the local player's machine or characters saved on the server. The first approach allows easy cheating, so we didn't use it. However, the second approach hasn't been a lot better:
At account creation, the game created the character and uploaded it to the server. That doesn't sound very secure and it isn't. In fact, this caused quite some unintentional issues. If an expansion player created some character with expansion features and logged into a non-expansion server, the server couldn't handle that suddenly "invalid" character data and simply crashed.
What should have been done instead is something a bit different: The client should tell the server what to create. But in the end the server determines how/what he creates and whether it accepts the parameters given. This is how pretty much any modern MMORPG handles its character creation process and other mechanics. If you still happen to pass some invalid value, you'll just receive an error message rather than see your character being created with invalid stats.
As you specifically asked to magically gain 100 points of some attribute or anything like that: If done right, there's nothing you can do without having access to the actual server. If all calculations (like damage) happen on the server, you simply can't influence or modify them.
Something like the injection you mentioned can have some - but at most minimal - effect based on how the game is written:
Let's assume upon login, the server sends the client some data package "permissions". This will tell the client what the player is allowed to see, for example spawn points or transitions usually not visible to the player. Using traffic manipulation, you could use a program to modify that package so the client thinks you're actually allowed to see that stuff (for example), yet this won't change how you appear to other players or the server (because that data should be verified by the server before being accepted and/or passed on).