Hi Phat,
Yes, as per requirement custom SQL scripts are forbidden, beside some specific cases, although definition for both MSSQL and MySQL would be needed.
Please use Files section in the Customization Project Editor in order to add the file to the customization project. For this I would suggest to place the file in the desired location on your development instance first, so when you would add the file to the customization project, the path will be saved as well. This way it will be deployed in the same path on production instance.
If it is an image and your requirement is to use it just for UI for your custom screen, then it should be possible to use it straight away without serializing it to DB. If you need it in Database as a File, you can use the UploadFileMaintenance graph instance in the implementation of your Customization Plug-in.