A client just alerted me that there is hidden code on some of his pages serving text adverts. The code is a hidden div that’s inserted at the top of each page - you can see it if you do View Source. However, when I download the pages in question, there is no such code there! I’ve now found similar issues on at least two other sites. Does anyone know what’s happening here? I don’t use WP or any other CMS, so it can’t be coming from there.
Correction - one site actually had the code inserted in several pages - I had to download and erase the code. But one other site still has it and the code is definitely not in the underlying source when I download the pages - so it must be inserted dynamically from the server?
We’ve seen a number of CMS systems hit by bots doing this, or anything with a non restricted file loader in many cases, or custom php.ini allowing remote file includes. Even in soem cases, frontpage brute force to use FP extensions to edit sites on a few.
For the most part it only requires one asp file on a site to be able to get this, to all domains in an account. Seeing a lot of things like uploadname.jpg.asp, this allows a bypass to rudimentary checks on some sites, but still execute as an asp file.