A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from exeterpress.co.uk.

I have been unable to find out where the injection is taking place, but I am suspecting their ad provider. Another possibility is that their sysadmin has an infected computer. Changing the database credentials and not alerting ANYONE of the change does not stop this. I implemented a PDO library everywhere a insert/update query is run on that table within their system (unfortunately not all insert/update queries are done yet - the site is HUGE - but will get there...).

My question is: Anyone else seen this in.js injection before, and if you solved it, how?

  • Never heard of it, code would help Mar 6, 2014 at 2:03
  • I've not seen this specific attack before, although exploiting SQL injection to ultimately serve malware or redirect users (via JS) isn't unheard of. Websites running an old version of a CMS (e.g. Wordpress) are often targeted by automated attacks. However, SQL injection exploits are rarely limited to the method used by the original query, so parametrised queries should be applied to every DB request, not just INSERT/UPDATE.
    – itscooper
    Mar 6, 2014 at 7:15
  • Thanks, itscooper, I plan on using PDO on all queries, but due to the sheer size of the site, I targeted those that I figured will be most likely compromised. All SQL queries regarding the banner ads do not rely on user input, so I have skipped those for now, but will obviously add protection there shortly. Thanks for your comment! Mar 6, 2014 at 9:55


You must log in to answer this question.

Browse other questions tagged .