fix a phising leak in out-of-date cms

I have a website which has become the victim of phishing. The ISP seems to think it comes from an out-of-date cms (Tiny CMS) script as we think we've elimiated everything else. What happens is that every morning the index page is set to nil and everything goes blank. It's a busy property website and we need this fixed as soon as possible. The successful bidder will have to be confident that they can fix it, even if it's not the problem I think it is.