XSS Attack

[Awjvail]

Hi there,

recently, my website has been the victim of an (apparent) xss attack.

However, from what I gather about XSS, you need to have either PHP or Javascript on a page in order to execute an attack on it.

There has been some javascript appearing on my pages which redirects to other pages; some being spyware websites. However, on my index.html, which I use to redirect to my forums, the only code in the whole page is this:

PHP Code:

<meta http-equiv="refresh"content="0;URL=/forums/index.php"> 


Is it possible to execute an XSS Attack on this? Some how they are sticking javascript onto that page.. the page has no exploitable things on it.. it is just a meta refresh bringing you to my forums homepage.

I have password protected my index.html with .htaccess, however the attacks keep coming and malicious javascript keeps getting injected into index.html.

Is this an XSS attack or something different? If so, what would it be?

The same code has also been injected into virtually every index.php and index.html I have on my server, mostly in directories which nobody even knows about - something I thought was only achievable by having server access.