A wave of new SQL injection attacks appears to have infected several thousand web servers, including government and financial services sites.