On two occasions, someone has managed to insert what appears to be malware code into one of my includes. I won't post the actual code, but it consists of a CFHTTP tag that references an IP address, and a CFOUTPUT tag that outputs the value of the CFHTTP. The site is not tied to a database, we only use CFINCLUDEs to simplify global edits (we're relatively new to ColdFusion). The site is hosted by one of Adobe's recommended CF hosting services. Any thoughts on how someone could be adding this code and what we can do to stop them?
↧