WP Hack attempt?

Did a google search and found this site: hackerthreads.org • View topic - XOOPS Module SQL scanner

From the site: "Scans a site with a list of vulnerable sql injections and searches source for md5'"

I'n not a coder, so I don't know exactly what it's doing, but most likely trying to hack your wordpress site.

Looks like they were targeting the wp-forum plugin which hasn't been patched in decades. Do you have that installed on your blog?

they're trying to gather user logins by passing a SQL statement through a GET request. the function to list forums or something must have been letting all requests through unfiltered and/or had not been using prepared statements in a previous version. the slashes escape the characters when input through PHP, so that's why the statement doesn't work when you copy/paste it.

When you see SQL query like that, they're attempting to do a SQL Injection hack. You'd be surprised how often it works when people don't sanitize their inputs.

Basically whats happening is that they are attempted to escape the string passed, so that it becomes a command. So for example if you had something like.

"SELECT * FROM Table Where id=".$userid." yada yada".

Well if userid isn't sanitized (especially since php can spit out either a integer or string) they could cause the SQL statement to become multilined. The first obviously would fail cuz its an impartial, but then it would also execute the rest of the string. You can typically fix this using mysql_real_escape_string() around the variable in some cases, which would escape the characters that would allow the execution. Unfortunately most people who get hit, aren't developers :/