I have a desktop based software that's built on top of SQL 2005. The SQL server is hosted inside my office, and there is 1 public facing website which displays some of the content from this database.
The problem i have
- The following HTML code has been injected into the description column for every single record in 1 of the tables for my database
<div style=position:absolute;top:-9999px;><a href=http://cashfastreiiu.com >cash fast</a><a href=http://guaranteedpaydayloansmsflg.com >guaranteed payday loans</a><a href=http://instantcashroacg.com >instant cash</a><a href=http://paydayloanstorezxucx.com >payday loan store</a><a href=http://paydaylendingvbmpz.com >payday lending</a></div>
- I did a google search just for the cashfastreiiu.com link and it appears that several other sites have the same exact HTML string in their database that even shows up on their public website.
My Questions is
How could this have happened ? Only port 80 is exposed for the HTTP server (IIS 7.5) and that server connects to the database using it's internal IP only. The SQL server is not exposed to the public. The desktop client application is run on 8 employee computers and these people are using Windows 7 computers in lock down mode with zero admin rights. They can't install applications with admin approval.
The public website is for viewing only, there is no method to update data from the public site.There is no way for anyone on the internet to update or enter data into the database.
Where should i start looking for holes in my security ?