Website Undergoes Changes Due To SQL Injection Exploit

USA (SANEPR.com) June 19, 2008 -- An established consumer debt informational website American Debt Advisor was the latest victim of the infamous SQL injection attack. The SQL injection exploit is a technique that exploits an SQL vulnerability occurring in an SQL database. This exploit is now well known and many websites are getting hit. In January 2008 tens of thousands of PCs were infected by an automated SQL injection attack that exploited a vulnerability in Microsoft SQL Server. Two months ago it became public that a server farm in China used the google search engine to find SQL servers that were vulnerable to their SQL injection tool.

The website owners didn't know they were infected by this SQL bug until someone contacted them to tell them that they were linking out to a variety of unrelated websites from within the Debt Fighter website. One of the sites owners explained "I received an email last friday from someone who notified me that a section of our website was linking to a bunch of gambling related websites."

The attack used a mailing list program Kevin created two years ago. Kevin said "once we realized how they did this we removed the entire script". After an in depth look at the servers log files they noticed an odd amount of hits coming from Chinese based IP's. "I don't know for sure but based on the links added and the server log files it looks like this may have been caused by someone within China."

On June 17th AmericanDebtAdvisor.com got major update and the mailing list software was removed. "Everything is cleared up now and we have taken some steps to prevent this from happening in the future."

A variety of companies now offer software that will check scripts to see if they are vulnerable to this type of attack.