The researchers suspect the criminals gained initial access by exploiting a probable SQL injection bug ... including physical path on the server, site name, IP address, and hostname, before dropping a ...