Multiple .edu sites reportedly victims of db theft

[John Stauffacher <john () CAFFEINATEDNETWORKS COM>]

All,

I came across an individual a few days ago on twitter (@abdilo_) that was
bragging about breaching multiple .edu's via sqli. He claimed
responsibility for a breach of Metropolitan State University, and this
afternoon dropped this partial list of .edu sites that he reportedly has
breached and absconded with their databases:

http://pastebin.com/yyhT6tzc
uq.edu.au
columbia.edu
usyd.edu.au
upf.edu
vcu.edu
williams.edu
monash.edu.au
uji.es
hu-berlin.de
exeter.ac.uk
mcmaster.ca
ubc.ca
waikato.ac.nz
uwa.edu.au
ohio-state.edu
handles.gu.se
iwm-kmrc.de
purdue.edu
lancs.ac.uk
uni-erlangen.de
luiss.it
unimib.it
purdue.edu
univ-montp1.fr
uw.edu.pl
pless.cz
inscripcions.org
uni-oldenburg.de
141.89.97.231
idecisions.org
uni-mannheim.e

If anyone on this list is a member of these organizations, or can reach out
to them -- it is important that they know. From the communication that I
have gotten from this person (all via twitter) this issue seems to be
systemic in some piece of software shared amongst all these groups. If that
is the case, then we are looking at a vendor related flaw -- and the
potential targets is pretty large.

-- 

John Stauffacher
GPG Fingerprint: 5756 3A3B ADA3 22A6 9B26 6CA8 DB8D 2AC3 7699 0BD