On Joint Reconstruction of State and Input-Output Injection Attacks for Nonlinear Systems