Re: Sql Inyection In My Forum :(
If I recall there were a number of possible injections into knowledge base, but I think they are patched - so possibly when they tried to do it, it triggered the private message, but they weren't actually able to insert the message in knowledge base?
Sometimes this sort of thing is actually done by a bot - the way to tell is look at your server's raw logs. Look for any tell-tale signs, like trying to access knowledgebase. If all you see is a couple of lines directly attempting to insert into the script, and not a load rows of text for the same IP, each one relating to a different part of your webpage (such as images, stylesheets and so on), then the webpage wasn't even loaded, it was just an attempt by a bot to insert via URL string. Often bot creators try and spoof browsers, its easy to create a c++ application that trawls the web and give false header info - indeed even mozilla can be tweaked to declare itself as IE - this used to be necessary a couple of years ago when a lot of site content was deliberately made MS-only (maybe not the developers themselves, but because they used MS web packages, often based on shoddy asp).
This is a guess, since I've never used/inspected knowledge base, but the attempt might not be detected by cracker tracker because it might be a legitimate query string normally used by the mod to send data, you couldn't put that query in the cracker tracker search pattern because it would stop legitimate users. If the data doesn't exist in your knowledge base, then that means its secure, and what we have now is a bug in the message management system, sending messages without checking that the data is actually in your database... just a guess mind you
Perhaps to rule it out, did you check your database and find anything in there?
Mexico
Classified
Borgo San Michele
are you the boy? 
