There have been a series of recent attacks on sites that are not patched current with Chatserv's 3.x series. This specially crafted url was also able to bypass the filters in NukeSentinel(tm). There's more to the story, but read the thread Recent UNION exploit with unpatched sites and NukeSentinel for the fix. The download will be corrected shortly.

Thanks to Technocrat for first making me aware of this and for also being persistent to get a good fix!