The attack vector is designed to infect all databases and all tables that can be accessed on a given MSSQL instance (by iterating database, then table, then column).  Under a cross-application infection scenario, even an unrelated vulnerable application (ASP.NET, classic ASP, or anything that touches the database in an unprotected manner) is capable of infecting the DNN tables. 

Proper MSSQL security configuration can almost completely mitigate this.  Since DNN uses stored procedures as its exclusive means of communication with the database layer, you can eliminate your attack surface for these sorts of attacks by denying SELECT and UPDATE permissions on your database (allowing only EXECUTE) to IIS application pool users.  For non-DNN applications, this might not be feasible.

It really is quite a beautiful attack, if not also annoying and destructive.

Brandon

Tony:

I don't want to post the actual injection code, but from the entries in my IIS logs I can tell you that you should look for entries using the linkclick module followed by a very long encoded string.  That string, when decoded, contains SQL code to iterate through all the tables, and all text fields found (actually similar to the SP procedure I recommended to do the global search), and then inject the damaging code, which is then included in the served pages to call a javascript file from some infected server.

The techniques used are indeed clever but like it was said before, they depend on very old vulnerabilities, which DNN does not have due to the due diligence of the Core Team.

Carlos

If  you are "curious" if you site has been targeted ... and you have enabled you sitelog.   Try the following via the Host> SQL  .  Alternatively you can use the Reports module or SQLGridSelectedView.   Note: I have limited the url to 100 characters, but you will be able to see the initial part of the attack.  

The select will display the most recent attemps and the url that was "injected."

select 
  datetime, 
  left(url,100) as [URL]
from 
  sitelog 
where 
  url like '%declare%' 
order by 
  datetime desc

The above found 29 attempts to "break in" to my site in the last 30 days.  The most attempts (9) coming on July 23rd.

Hope this helps.
Paul.