Ouch. For a company like Kaspersky this is about as damaging as it gets. The screenshots suggest the author really 'did it', though I wonder why he chose to write about it instead of alerting Kaspersky.
One more reason to make sure you check each and every avenue of user supplied data for SQL injection. What really surprises me is that they don't use prepared statements.
>"I wonder why he chose to write about it instead of alerting Kaspersky"
Because if a security software company cannot secure it's own data, they must be ashamed of themselves.
By making their shame public, the guy is trying to make them work harder.
Or RossM is right and he's doing it for "fame".
I'm not sure what building a secure PHP support applications and building antivirus software have to do with each other. But then, I'm also not sure what antivirus has to do with security, so maybe you're right.
One more reason to make sure you check each and every avenue of user supplied data for SQL injection. What really surprises me is that they don't use prepared statements.