Did my CMSMS get hacked ? [SOLVED - kind of]

thomahawk · Post by **thomahawk** » Thu Dec 11, 2014 7:17 pm

We found a code snippet at the end of the index.php. Usually it ends like this

# vim:ts=4 sw=4 noet
?>

but at one website (thanks to a Norton warning) I found this at the end of the page

Code: Select all

I first thought I had this put in for pretty URL's but as far as I understand it, it does something different. Or someone knows this?

Thanks for your feedback
Thom

thomahawk · Post by **thomahawk** » Thu Dec 11, 2014 7:28 pm

We found the same code in several other pages too.

My developer Page on the Forge · Post by **Jo Morg** » Thu Dec 11, 2014 7:32 pm

That code is not part of the official release. It's a possible infection.

* note: pasting those code spinets is not allowed as they are signatures by which virus can be identified and may blacklist the forum.

thomahawk · Post by **thomahawk** » Thu Dec 11, 2014 7:34 pm

Ok, thanks. Well, after so many years with CMSMS, I have never seen a hacked site. Is it possible to change index.php through CMSMS itself? Or only by hacking FTP?

My developer Page on the Forge · Post by **Jo Morg** » Thu Dec 11, 2014 7:38 pm

r=&sv=0&sc=1&sf=all&sk=t&sd=d&sr=posts&st=0&ch=300&t=0&submit=Search

There are even a few topics about steps to recover from possible hacks.

Keep in mind that CMSMS is not the weak link in all the of occurrences I know of.

thomahawk · Post by **thomahawk** » Thu Dec 11, 2014 7:45 pm

Well, one of your team thinks its originally a wordpress virus. I would be very surprised if the problem was CMSMS, because I always take the recommended security measures, setting most limited ftp permissions to files, rename the admin folder and so on.

Dr.CSS · Post by **Dr.CSS** » Thu Dec 11, 2014 7:51 pm

If you found strange code in your index.php you can remove it and replace it with a fresh one from the tar.gz of the same cmsms version, unpack and upload to site...

My developer Page on the Forge · Post by **Jo Morg** » Thu Dec 11, 2014 7:51 pm

Bummer I originally wanted to post this link:
http://forum.cmsmadesimple.org/posting.php?
Something went wrong sorry.

thomahawk wrote:Well, one of your team thinks its originally a wordpress virus.

Most possibly. And sorry for my previous quite cryptic post...

thomahawk · Post by **thomahawk** » Thu Dec 11, 2014 7:56 pm

Jo, the second link also seems to be wrong. For me it only opens a new post form.

My developer Page on the Forge · Post by **Jo Morg** » Thu Dec 11, 2014 8:02 pm

Not on my best days... and the stupid keyboard is not helping either...

Let's try again: http://forum.cmsmadesimple.org/search.p ... rds=hacked

My developer Page on the Forge · Post by **Jo Morg** » Thu Dec 11, 2014 8:12 pm

http://forum.cmsmadesimple.org/viewtopi ... 28&t=69570
this is possibly one of the best topics about it.

thomahawk · Post by **thomahawk** » Fri Dec 12, 2014 8:36 pm

Okay, it seems somehow there was a worpress installation running on that hosting, or however, a wordpress virus got in or was there and infected php files of the same name and location as they would be in a wordpress installation. This happened not just now, but about a year ago on first CMSMS install. About 11 php files where infected. Not a serious virus, just data collection as it seems, and the collectors server not active anymore.

However, we used that for making a upgrade of CMSMS and get rid of the infected files. Could have been done manually too on that 11 files. Hope that bugger does not come back again.

CMS Made Simple Forums

Did my CMSMS get hacked ? [SOLVED - kind of]

Did my CMSMS get hacked ? [SOLVED - kind of]

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ?

Re: Did my CMSMS get hacked ? [SOLVED - kind of]