The most likely cause of infection would be either SQL injection or cross site scripting. You probably already know what both of those are but just in case...
XXS or "cross site scripting" is most commonly found where a site allows a user to upload content to a page (say on a forum or comment section or whatever) without checking and validating the content - or perhaps poorly checking and validating the content. So a nefarious user uploads his HTML / JS as a comment and the next person viewing the comment executes the script.
SQLi (and I'd bet on this one) is where a nefarious user sends executable SQL along with URL or FORM (or cookie) params. It's most common where someone uses numeric "ids" - say ?news_Id=4 for a news story - and the DB is configured for multiple statements. Careless programmers allow the URL param to pass directly to the DB without qualifying it as a number... so someone can put something like ?news_id=4; update tableA set title=..... you get the idea. SQLi attacks can be really tricky and involve executing evaluated encoded hexes and the like.
So a "best guess" would be that someone has an unprotected query that is being hit by SQLi - and that's appending this JS to some content that is put out to the page.