There's not enough information to be sure, but it sounds kind of like an SQL injection type of issue. Which would be very surprising as that's been known about

There's not enough information to be sure, but it sounds kind of like an SQL injection type of issue. Which would be very surprising as that's been known about for many years and all systems should have some kind of input validation setup in place to prevent it. I suppose such any such setup could be overridden by someone with the appropriate level of access however.