My subject says it all - I am clueless as to how a file with permissions 0644 can keep getting iframe injections. None of the posts on this site that I saw quite described what I am experiencing. Every two days or so, an iframe gets injected into some files with 0644 permissions. Just as I think we've got it covered, it happens again.
We have searched the database for stored XSS or SQL Injection attempts, and do not find anything that corresponds to putting an iframe in these files, unless it is heavily obfuscated.
My question is: How do I stop this?