I'm getting the exact same type of injection.
Right now I'm running a search and replace on the entire DB to see how many tables/columns this has changed.

Please do share if you have any update...