1

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from exeterpress.co.uk.

I have been unable to find out where the injection is taking place, but I am suspecting their ad provider. Another possibility is that their sysadmin has an infected computer. Changing the database credentials and not alerting ANYONE of the change does not stop this. I implemented a PDO library everywhere a insert/update query is run on that table within their system (unfortunately not all insert/update queries are done yet - the site is HUGE - but will get there...).

My question is: Anyone else seen this in.js injection before, and if you solved it, how?

  • Never heard of it, code would help – David Houde Mar 6 '14 at 2:03
  • I've not seen this specific attack before, although exploiting SQL injection to ultimately serve malware or redirect users (via JS) isn't unheard of. Websites running an old version of a CMS (e.g. Wordpress) are often targeted by automated attacks. However, SQL injection exploits are rarely limited to the method used by the original query, so parametrised queries should be applied to every DB request, not just INSERT/UPDATE. – itscooper Mar 6 '14 at 7:15
  • Thanks, itscooper, I plan on using PDO on all queries, but due to the sheer size of the site, I targeted those that I figured will be most likely compromised. All SQL queries regarding the banner ads do not rely on user input, so I have skipped those for now, but will obviously add protection there shortly. Thanks for your comment! – Kobus Myburgh Mar 6 '14 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.