ATTENTENTION Webmasters - possible security vulnerability on school networks

[Andrew Schreiber]

Try renaming the page then having index.php redirect to index1.php. Odd problem.

[ZInventor]

we tried that, but it seems that the redirect connects the files just enough to cause the divs to keep appearing!

once the tech gets back, we'll try migrating the entire site to a different location on the server, then moving the DNS reference...

hopefully, that'll help.

-Z

[OScubed]

It looks like link generating spam. This is placed into remote sites to point back at other sites for advertising SEO. Many spiders won't notice that they are in a hidden div, so the links back to the original sites increase (in a black hat kind of way) the linkscore of the target.

Have you commented out the following JS to be sure they're not injecting the div:

Colourloverscolorpicker.js
print.js
ddaccordion.js
lnews.js

Check this link on the moodle site for additional info:
http://moodle.org/mod/forum/discuss.php?d=116103

If your webmaster downloaded a template from a "free site" the linkspam js may be embedded in the moodle skin.

[ZInventor]

Originally Posted by OScubed

Have you commented out the following JS to be sure they're not injecting the div:

Colourloverscolorpicker.js
print.js
ddaccordion.js
lnews.js

lnews.js and print.js are scripts we've written, and both of the other scripts have been heavily modified, and do not reference any other files, unless i missed something... (after all, i was working late at night)

now that you mention it,i've re-checked the scripts, and they are all clean...

the only scipt i haven't modified is http://ajax.googleapis.com/ajax/libs.../jquery.min.js, but i use that on several other sites without any issues...

looking at the pages referenced in the ghost div, it doesn't seem to be for advertizing... all the pages seem to be located on sites they have no relation to, most of which are schools and universities, and all of which run moodle

i wasn't able to get to the moodle discussuion board, as i do not have an account... however, i will talk with the tech coordinator at school to see if he has one.

thanks for the thought though,

-Z