All cms blocks inserted an unauthorized link with js call as below https://kinfirighbetted.host/d/domain.com.js


Your site is hacked, you should manually remove code from CMS block, also be sure to search complete data base for 'kinfirighbetted' string to be sure that code is not injected in CMS pages as well.

Ask your hosting company to check for recently modified files and you might be able to find what caused issue.

Cheers !

  • i have removed all links from the database. I checked with my hosting company only cache files are modified. – shyopat Nov 23 '18 at 12:09
  • Great news I hope that it didn't made any harm to your customers. It would be good if you can check in next few days will it happen again. We have client with similar issue and use 3rd party software to observer changes in files and perform data base scan on on daily basis. Thanks ! – SMD Milan Nov 23 '18 at 13:47

If you add CSP headers, this will prevent that this script will load in the browser. So as long as it's not clear how it's possible and it happens again, you protect your clients with the CSP headers.

See owasp for what a CSP is https://www.owasp.org/index.php/Content_Security_Policy

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.