RawAlex
12-31-2007, 01:06 PM
This isn't 0-day or anything like that, but within the last few days I have had a number of posts over different blogs have an iframe added DIRECTLY INTO THE POST data, which connected to a chinese site that appears to be installing toolbars and back doors.
Go to your blog database, and do the following query:
SELECT * FROM `wp_posts` WHERE post_content like "%<ifram%"
If you get anything, check them closely. It is either an ip address or the domain wp-stats-php.info.
This is a serious issue, at least one of the sites I found it on has tumbled to the very bottom of google results from page 1 on good keyword pairs.
Go to your blog database, and do the following query:
SELECT * FROM `wp_posts` WHERE post_content like "%<ifram%"
If you get anything, check them closely. It is either an ip address or the domain wp-stats-php.info.
This is a serious issue, at least one of the sites I found it on has tumbled to the very bottom of google results from page 1 on good keyword pairs.