The root issue was web server file permissions. A certain Windows users group had full permissions recursively to all web files. One site was compromised and was used to inject files on the entire server.

First you need to make sure your site’s file permissions are secure, depending on your host you may not be able to see the entire ACL (access control list) for your files. If that’s the case just ask them to double check to make sure no random Windows users groups have write permissions to your files.

Second also verify the original compromise was not an FTP compromise. Have your host check the FTP logs from the day your files were injected. If it was an FTP compromise, update your passwords and scan all workstations used to connect via FTP for viruses, loggers, sniffers, etc..

If it wasn’t an FTP compromise have your host double check the sandbox securities in ColdFusion admin and verify that no other sites have something stupid like recursive write access to the directory where all the websites are stored.

Assuming your site is on a Windows server have your host setup Windows file auditing/logging for the EVERYONE group on a few of the files that got injected previously. That way if it does happen again you (well, your host) will have evidence of what Windows user wrote to the file.

Hope that helps.

Thanks!

Preventing SQL injection is a matter of sanitizing all GET and POST variables.

http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_Injection