A new SQL injection attack has compromised tens of thousands of URLs according to a security vendor. The attack was initially used to push rogue AV malware.