I maintain a small site that runs old-fashioned classic ASP pages with an Access backend.
Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. Mostly it was static content, lots of links to dubious sites, that sort of thing, with a bit of scripting thrown in. I didn't stop to analyse the scripts - I just deleted everything and reposted the page.
There's nothing in that index page which accepts dynamic input: no search boxes, no file uploads, no querystrings. There is elsewhere on the site, which includes some simple forums software, but not on the front page.
Because there's no input on the page that got hacked, I presumed this was a flaw in the host's defences, and alerted them to the fact there might be a problem. After a couple of days, they got back to me claiming they were fully secure and the attacker must have used some form of injection attack to do the damage.
This surprised and alarmed me, because I was not aware that there were techniques to use injection on pages that don't accept any input. But my knowledge of security isn't great, so if there are, I want to know about them.
So, how can an injection attack get on a page that doesn't have a form or a querystring? Or are my hosting company bluffing, and there's a possible flaw in their security?