Normally I'd ask you to share a link to your problem page/site but in this case I think I'll avoid any visits to your site until the issue is resolved... ;)
First, let's assume for the moment that your user membership security is ok (i.e., no one managed to compromise user accounts and give themselves an admin or editor role). The more likely cause is that someone has instead injected script via a security hole in a module.
What modules do you use on that DNN instance? Do you run more than one portal on the instance? If so, security may have been breached on a different portal.
A good first place to look is any module that allows user input / feedback. Blog comments, chat, forums, Feedback, etc.
To speed up the search for the offending module (assuming script injection), I recommend that you employ a database table search routine to look for a unique piece of the injected code (such as the "212cafe" URL). Here's one I use a decent bit -- unfortunately it's too much to simply plug into the HOST->SQL option in the DNN UI -- DNN will churn on it a bit and then tell you (incorrectly) that the code is bad. Instead, you'll need to execute this as a SQL query in your web host's DB admin interface or create and run it as a stored procedure. Replace "212cafe" with whatever string or integer value you want to search for:
declare @SearchStr nvarchar(100)
set @SearchStr = '212cafe'
CREATE TABLE #Results (ColumnName nvarchar(370), ColumnValue nvarchar(3630))
DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110)
SET @TableName = ''
SET @SearchStr2 = QUOTENAME('%' + @SearchStr + '%','''')
WHILE @TableName IS NOT NULL
BEGIN
SET @ColumnName = ''
SET @TableName =
( SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
FROM INformATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE'
AND QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
AND OBJECTPROPERTY(OBJECT_ID(
QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)),
'IsMSShipped') = 0)
WHILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
BEGIN
SET @ColumnName =
( SELECT MIN(QUOTENAME(COLUMN_NAME))
FROM INformATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = PARSENAME(@TableName, 2)
AND TABLE_NAME = PARSENAME(@TableName, 1)
AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar', 'int')
AND QUOTENAME(COLUMN_NAME) > @ColumnName)
IF @ColumnName IS NOT NULL
BEGIN
INSERT INTO #Results
EXEC
( 'SELECT DISTINCT ''' + @TableName + '.' + @ColumnName + ''', LEFT(' + @ColumnName + ', 3630)
FROM ' + @TableName + ' (NOLOCK) ' +
' WHERE ' + @ColumnName + ' LIKE ' + @SearchStr2)
END
END
END
SELECT ColumnName, ColumnValue FROM #Results
Good luck!
-mamlin