Skip to main content
A
Anonymous
May 14, 2008
Question

Spam is adding href links to index page

  • May 14, 2008
  • 4 replies
  • 558 views
Periodically, we are seeing, only on index.cfm pages oddly enough, malicious appending of href links for Viagra, Xanas, etc. The href links are contained inside a non-visible DIV block just before the end of the body tag.

I removed them once, but now they keep coming back.

There is no include script on the affected page that allows user entry such as a form.

Any idea how this could happen where href links are appended to an existing page? We do have a CMS, but it only allows updates to the DB, not any HTML files.

Could this be a malicious javascript function somewhere on the site?

Having not seen this issue before, any ideas are welcome!
This topic has been closed for replies.

4 replies

T
tmschmitt
Participating Frequently
May 15, 2008
If you are using a hosting company, contact them immediately, as your server security has been breached. I would think about changing all your passwords for starters.
Probably a good chance they are coming in via FTP and updating your files. I saw this at my last hosting company.
A
Amiable_Penguin15D5
Participating Frequently
May 14, 2008
Check the timestamp on the actual template in question. Odds are you have a hole in your web server's security somewhere and someone's been able to drop a script in somewhere and can alter any of your templates at will. Depending on your OS and web server, there could be any number of ways for someone to get in.

When I ran a web hosting company, we had it happen where through an older version of OpenSSH, someone was able to get onto the server and update all of the Linux command files with versions that also ran a key logger, so anything we did on the command line was recorded and sent to some other server. We also had intrusions through poorly created PHP applications (phpBB anyone?) that allowed anyone to drop code into any file they chose.
N
Newsgroup_User
Inspiring
May 14, 2008
Kronin555 wrote:
> Is the HTML with the invisible DIV and href tag actually being written to the
> index.cfm file? or is it being added to the end of content in your database
> that is pulled in and displayed on your index.cfm page?
>

OR is the nefarious content being added during runtime?
K
Kronin555
Participating Frequently
May 14, 2008
Is the HTML with the invisible DIV and href tag actually being written to the index.cfm file? or is it being added to the end of content in your database that is pulled in and displayed on your index.cfm page?
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices