Magento 1 Have Suspicious script in head but not declared anywhere

Question

I found a suspicious and possibly dangerous script in the head of a magento 1 site. The script doesn't appear to be declared anywhere. I can't find it in the DB. Where else should I look to see where it's coming from?

Answer 1

It could be in config or cms block or in cms page

I don't have M1.9 DB, but I guess 1.9 and 2 DB is same for above tables, so try these queries

SELECT * FROM core_config_data WHERE `value` LIKE '%PART OF THE SCRIPT%';

SELECT * FROM cms_block WHERE content LIKE '%PART OF THE SCRIPT%';

SELECT * FROM cms_page WHERE content LIKE  '%PART OF THE SCRIPT%';

Hope you will find the script in your DB

Edited:

I guess the script that is you need to find in above tables is this:

<script type="text/javascript">//<![CDATA[
    var Translator = new Translate({"Please select an option.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05e4\u05e9\u05e8\u05d5\u05ea.","This is a required field.":"\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d4\u05d9\u05e0\u05d5 \u05d7\u05d5\u05d1\u05d4.","Please enter a valid number in this field.":"\u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d9\u05e9 \u05dc\u05d4\u05e7\u05dc\u05d9\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d7\u05d5\u05e7\u05d9.","Please use only letters (a-z), numbers (0-9) or underscore(_) in this field, first character should be a letter.":"\u05d0\u05e0\u05d0 \u05d4\u05e9\u05ea\u05de\u05e9 \u05d1\u05e1\u05e4\u05e8\u05d5\u05ea (0-9), \u05d0\u05d5\u05ea\u05d9\u05d5\u05ea (\u05d0-\u05ea, a-z), \u05d0\u05d5 \u05e7\u05d5 \u05ea\u05d7\u05ea\u05d5\u05df (_) , \u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4. \u05ea\u05d5 \u05e8\u05d0\u05e9\u05d5\u05df \u05e6\u05e8\u05d9\u05da \u05dc\u05d4\u05d9\u05d5\u05ea \u05d0\u05d5\u05ea.","Please enter a valid phone number. For example (123) 456-7890 or 123-456-7890.":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d8\u05dc\u05e4\u05d5\u05df \u05ea\u05e7\u05e0\u05d9, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: (123) 456-7890 \u05d0\u05d5 123-456-7890","Please enter a valid date.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05ea\u05d0\u05e8\u05d9\u05da \u05d7\u05d5\u05e7\u05d9.","Please enter a valid email address. For example johndoe@domain.com.":"\u05d4\u05e7\u05dc\u05d3 \u05db\u05ea\u05d5\u05d1\u05ea \u05d3\u05d5\u05d0\u05e8 \u05d0\u05dc\u05e7\u05d8\u05e8\u05d5\u05e0\u05d9 \u05ea\u05e7\u05d9\u05e0\u05d4, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: johndoe@domain.com.","Please make sure your passwords match.":"\u05d0\u05e0\u05d0 \u05d5\u05d3\u05d0 \u05e9\u05e1\u05d9\u05e1\u05de\u05d0\u05d5\u05ea \u05ea\u05d5\u05d0\u05de\u05d5\u05ea.","Please enter a valid URL. For example http:\/\/www.example.com or www.example.com":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05db\u05ea\u05d5\u05d1\u05ea \u05d7\u05d5\u05e7\u05d9\u05ea, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: http:\/\/www.example.com or www.example.com","Please enter a valid social security number. For example 123-45-6789.":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d1\u05d9\u05d8\u05d5\u05d7 \u05dc\u05d0\u05d5\u05de\u05d9\/\u05ea.\u05d6. \u05ea\u05e7\u05e0\u05d9, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: 123456789","Please enter a valid zip code. For example 90602 or 90602-1234.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05de\u05d9\u05e7\u05d5\u05d3. \u05dc\u05d3\u05d5\u05d2\u05de\u05d0 69020","Please enter a valid zip code.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05de\u05d9\u05e7\u05d5\u05d3 \u05ea\u05e7\u05d9\u05df.","Please use this date format: dd\/mm\/yyyy. For example 17\/03\/2006 for the 17th of March, 2006.":"\u05d0\u05e0\u05d0 \u05d4\u05e9\u05ea\u05de\u05e9 \u05d1\u05e4\u05d5\u05e8\u05de\u05d8 \u05ea\u05d0\u05e8\u05d9\u05da \u05de\u05e1\u05d5\u05d2 dd\/mm\/yyyy, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: 17\/03\/2006 \u05e2\u05d1\u05d5\u05e8 \u05d4- 17 \u05dc\u05de\u05e8\u05e5, 2006.","Please enter a valid $ amount. For example $100.00.":"\u05d1\u05d1\u05e7\u05e9\u05d4 \u05d4\u05db\u05e0\u05e1 \u05e1\u05db\u05d5\u05dd \u05ea\u05e7\u05d9\u05df \u05dc\u05d3\u05d5\u05d2\u05de\u05d0 $100.00.","Please select one of the above options.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05d7\u05ea \u05d4\u05d0\u05e4\u05e9\u05e8\u05d5\u05d9\u05d5\u05ea \u05dc\u05e2\u05d9\u05dc.","Please select one of the options.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05d7\u05ea \u05d4\u05d0\u05e4\u05e9\u05e8\u05d5\u05d9\u05d5\u05ea.","Please select State\/Province.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05de\u05d3\u05d9\u05e0\u05d4\/\u05d0\u05d6\u05d5\u05e8.","Please enter a number greater than 0 in this field.":"\u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d9\u05e9 \u05dc\u05d4\u05e7\u05dc\u05d9\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d4\u05d2\u05d3\u05d5\u05dc \u05de-0","Please enter a valid credit card number.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05de\u05e1\u05e4\u05e8 \u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05ea\u05e7\u05d9\u05df.","Incorrect credit card expiration date.":"\u05ea\u05d5\u05e7\u05e3 \u05d4\u05db\u05e8\u05d8\u05d9\u05e1 \u05e9\u05d2\u05d5\u05d9","Please wait, loading...":"\u05d0\u05e0\u05d0 \u05d4\u05de\u05ea\u05df, \u05d8\u05d5\u05e2\u05df...","Complete":"\u05d4\u05d5\u05e9\u05dc\u05dd","Add Products":"\u05d4\u05d5\u05e1\u05e3 \u05de\u05d5\u05e6\u05e8\u05d9\u05dd","Please specify shipping method.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05e9\u05d9\u05d8\u05ea \u05e9\u05d9\u05dc\u05d5\u05d7.","Please specify payment method.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05e9\u05d9\u05d8\u05ea \u05ea\u05e9\u05dc\u05d5\u05dd.","Add to Cart":"\u05d4\u05d5\u05e1\u05e3 \u05dc\u05e1\u05dc","In Stock":"\u05d1\u05de\u05dc\u05d0\u05d9","Out of Stock":"\u05dc\u05e4\u05e8\u05d8\u05d9\u05dd \u05d5\u05de\u05d7\u05d9\u05e8\u05d9\u05dd \u05d0\u05e0\u05d0 \u05e4\u05e0\u05d4 \u05dc\u05e9\u05d9\u05e8\u05d5\u05ea \u05dc\u05e7\u05d5\u05d7\u05d5\u05ea","Shipping method has been changed, cancelling payment":"\u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7 \u05e9\u05d5\u05e0\u05ea\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd","Please select shipping method first":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7","Checkout form validation failed":"\u05d4\u05d5\u05d5\u05dc\u05d9\u05d3\u05e6\u05d9\u05d4 \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e0\u05db\u05e9\u05dc\u05d4","One of the required fields has been changed, cancelling payment":"\u05d0\u05d7\u05d3 \u05d4\u05d0\u05dc\u05de\u05e0\u05d8\u05d9\u05dd \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e9\u05d5\u05e0\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd","Please select billing address":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05d7\u05d9\u05d5\u05d1","Please select shipping address":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05de\u05e9\u05dc\u05d5\u05d7","Please accept our Terms and Conditions":"\u05d0\u05e0\u05d0 \u05e7\u05d1\u05dc \u05d5\u05d0\u05e9\u05e8 \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05e9\u05dc \u05d4\u05d0\u05ea\u05e8","In order to proceed please accept our Terms and Conditions":"\u05e2\u05dc\u05d9\u05da \u05dc\u05e7\u05d1\u05dc \u05d0\u05ea \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05d1\u05d0\u05ea\u05e8 \u05e9\u05dc\u05e0\u05d5 \u05e2\u05dc \u05de\u05e0\u05ea \u05dc\u05d4\u05de\u05e9\u05d9\u05da","Please agree with all sales Terms and Conditions":"\u05d0\u05e0\u05d0 \u05e7\u05d1\u05dc \u05d5\u05d0\u05e9\u05e8 \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05e9\u05dc \u05d4\u05d0\u05ea\u05e8","Please make sure all required fields are filled out correctly and shipping method selected":"\u05d0\u05e0\u05d0 \u05d1\u05d3\u05d5\u05e7 \u05d0\u05dd \u05de\u05dc\u05d0\u05ea \u05db\u05dc \u05e9\u05d3\u05d5\u05ea \u05d4\u05d7\u05d5\u05d1\u05d4 (\u05db\u05d2\u05d5\u05df \u05e9\u05dd, \u05d3\u05d5\u05d0\u05e8 \u05d0\u05dc\u05e7\u05d8\u05e8\u05d5\u05e0\u05d9, \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05d7\u05d9\u05d5\u05d1, \u05ea\u05e0\u05d0\u05d9 \u05e9\u05d9\u05de\u05d5\u05e9 \u05d5\u05d0\u05d7\u05e8\u05d9\u05dd) \u05d5\u05d1\u05d7\u05e8\u05ea \u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7.","Form element value has been changed, cancelling payment":"\u05d0\u05d7\u05d3 \u05d4\u05d0\u05dc\u05de\u05e0\u05d8\u05d9\u05dd \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e9\u05d5\u05e0\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd"});
    //]]></script>

Find this script and remove it, I think this is the root cause of the suspicious script