Enumerating SQL-injection vulnerable content providers