My site has been hacked

[malcek]

Three days ago we noticed at first increase usage on our site. Today we have discovered that somebody has been hacked our administration.
How they manage to pass our security i don't know.

But now we have new instalation of wordpress web site. Front office is working well.
Directories of adminstration that has been accessed:
- autoupgrade
- filemanager
- themes
- .htaccess file in administration directory.

 

Did anybody expirience same hack?
best regards,

martin

[Mediacom87]

Hi,

Many sites were hacked this week, so it's important to clean up your entire hosting space, identifying the point of entry and potential vulnerabilities.

Many third-party modules contain security holes.

I've already published quite a few articles on the subject to help people out, but at some point it's worth getting a professional involved, given the time involved.

 

[malcek]

entire public_html directory or complete cpanel account?

Best regards
Martin

[Nickz]

Wordpress is the most hacked Installation there is, also due to being popular  and the initial install over a Cpanel hostings are especially insecure.
Cpanel install prestashop has the same install folder name, the WP install uses the same admin name all over.

We are living in times where get rich quick or die trying is fashionable. Moreso if you are already close to the XXX scene.  
Many hacks in CMS are based on sql injection. Proper validation helps to avoid those.

[malcek]

2 minutes ago, Nickz said:

Wordpress is the most hacked Installation there is, also due to being popular  and the initial install over a Cpanel hostings are especially insecure.
Cpanel install prestashop has the same install folder name, the WP install uses the same admin name all over.

We are living in times where get rich quick or die trying is fashionable. Moreso if you are already close to the XXX scene.  
Many hacks in CMS are based on sql injection. Proper validation helps to avoid those.

but i never use wordpress 🤔

[Mediacom87]

il y a 6 minutes, malcek a dit :

entire public_html directory or complete cpanel account?

Best regards
Martin

public_html only.

[Nickz]

2 minutes ago, malcek said:

but i never use wordpress

It does not refer exclusively to wordpress. All CMS use a database when having a contact form. That is the way hackers take advantage of it.

[Mediacom87]

il y a 10 minutes, malcek a dit :

but i never use wordpress 🤔

This hacker didn't install WordPress but files named as native WordPress files.