His solution allows SQLmap 0.8 to parses XML data from the SOAP protocol by modifying three files from the package. He’s made the diff files available if you need this functionality for your own ...

While investigating the campaign, Qualys also discovered evidence that the attackers had accessed customers' data, including logs showing that they looked for SQL injection bugs using the sqlmap tool.