Re: SQL injection embeded .js file to execute CF hack

["Kronin555" <webforumsuser@xxxxxxxxxxxxxx>]

> 2. If database parameters are not locked, what are the possible attacks 
available to SQL injection

 Absolutely anything can be done that the user set up in the datasource can do. 
If the user has rights to drop tables, then a SQL injection attack could drop 
whole tables, etc.

 That said, it sounds like there are new files on the server (you reference new 
.js files and .xml files). Are there any sections of the site that allow users 
to upload files? What other services are running on the server that are 
accepting connections? Sounds like there's more going on than a simple SQL 
injection attack.