One million web pages attacked by lilupophilupop S

hankwang writes: The Internet Storm Center reported that one million web pages have been attacked by a the Lilupophilupop SQL injection and contain a malicious javascript link. Affected sites can be found using a a Google search query. See also the technical details of the SQL injection. The attack is directed to sites running ASP or ColdFusion with an MSSQL back end. The payload of the javascript leads, via redirects and obfuscated javascript, to a fake download page for Adobe Flash and antivirus software.