I have a client who's asked me to try and analyze a site for vulnerability.
What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same thing every time. From
Jewelery <a href="http://[**REMOVED-FOR-SF**]/viewPress?press_id=407">[**REMOVED-FOR-SF**]</a><a href="http://[**REMOVED-FOR-SF**]/[**REMOVED-FOR-SF**].html">[**REMOVED-FOR-SF**]</a>. The fact that it's always the same record makes me think it's some sort of automated script, but if it is, I can't find it.
The following has been accomplished:
- Fixed SQL injection vulnerabilities
- Prevented PHP execution in 777 directories
- Changed the database password after every fix
- Changed the CMS password after every fix
What's the next step?