Up to 130,000 websites have been compromised by a 'Trojan cocktail' being distributed by mass SQL injections.