site stop works, blank page

[uloloi]

Do you know what does it mean?:

Warning: Cannot modify header information - headers already sent by (output started at ......\config.php:1) in ......\include.php on line 94 Warning: Cannot modify header information - headers already sent by (output started at ......\config.php:1) in ......\include.php on line 97 Warning: Cannot modify header information - headers already sent by (output started at ......\config.php:1) in ......\include.php on line 100 Warning: Cannot modify header information - headers already sent by (output started at ......\include.php on line 107

Before that, the site had a stranger line of code, or tag in the source code. Something like a script, p.e.
[script type="text/javascript" src="http://foreverXXXXXn.nXXXXi.net/fkVWiAz ... d=81635277" ... ] and several like that

this is my site with the problem

[Jo Morg]

Apparently your site has been hacked. How much damage and how to fix it depend on a few things. Best way (hopefully you have a recent backup):
- Restore from backup;
- change db credentials;
- change site backend users credentials;
- backup;
- update to the latest core and modules;
- backup;

Eventually check if there are other open doors to re-hack the site (other scripts with weaknesses, etc).

HTH

[uloloi]

Done. All your recommendation. Thanks. Is there a way to know or at least been watching if someone spy or introduce malicious coding to the site? Imagine, to be making all of that everytime that happen this mortal attack!

I read that several CMSs have many vulnerabilities and holes which can be back doors to malicious agents like this. Is it true?

[Rolf]

I read that several CMSs have many vulnerabilities and holes which can be back doors to malicious agents like this. Is it true?

No, not for (the latest release of) CMSMS. At least we are not aware of any... If so we would have fixed it immediately and released a new core version. Using an older core version, everything is possible... for *all* CMS's. Upgrading isn't optional.

[zaidcrowe]

just to chip in - security is a massive priority for the dev team, they jump on the and verify that they are "real" if identified and prioritise fixes, they really are top notch at this!

worth mentioning that while the core system is secure - there are plenty of ways that your server setup, or the way you build sites can expose "vulnerabilities"

[uloloi]

Very hacked. Impossible to repair, unfortunately.

If I recommend to costumers to move to another dns domain pointing, would be useful?, transfer the domain to another servers? I find that currently hosting server works under windows platform, maybe this should have incompatibilities with the CMS. The support team help to me, they cleared all files and reinstall, install latest CMS version, permissions (ftp, user, db), etc, more than three times changed, and nothing fix this damage

What the hell! I never have this problem before. Sorry, I need more suggestions, and thanks again to everyone

[calguy1000]

If you have re-installed CMSMS from scratch and a virgin installation of CMSMS is still getting hacked then I would tend to think that it's a problem with the host... or vulnerabilities in other software (if any) that you are using on the same account.

i.e: if you have W***Press installed beside CMSMS in the same account, your install of that other software may have a vulnerability that allows hackers to pollute CMSMS files.

Either way. Before you move hosts, etc. You need to isolate and identify the problem or it could just be a waste of time. You need to analyse server logs, check the installs see what is being modified, when, and by what script.

[Rolf]

Very hacked. Impossible to repair, unfortunately.

If the database is untouched, the website is definitely fixable! I have done several...

[fearmydesign]

...man... I have the same errors, but this is a fresh install of CMSMS, and it all started happening when I was trying to add Pretty URLs - Does this also mean my copy got hacked? I didn't notice anything strange or anything

Code: Select all

Warning: Cannot modify header information - headers already sent by (output started at /home/content/32/223455/html/config.php:16) in /home/content/32/223455/html/index.php on line 155

Warning: Cannot modify header information - headers already sent by (output started at /home/content/32/223455/html/config.php:16) in /home/content/32/223455/html/index.php on line 156

Warning: Cannot modify header information - headers already sent by (output started at /home/content/32/223455/html/config.php:16) in /home/content/32/223455/html/index.php on line 157

Warning: Cannot modify header information - headers already sent by (output started at /home/content/32/223455/html/config.php:16) in /home/content/32/223455/html/index.php on line 158

Warning: Cannot modify header information - headers already sent by (output started at /home/content/32/223455/html/config.php:16) in /home/content/32/223455/html/index.php on line 159

[calguy1000]

That error message is very clear and very obvious.

You have an error in your config.php file.

[fearmydesign]

That error message is very clear and very obvious.

You have an error in your config.php file.

Originally that's what I thought... but there's nothing wrong that I can see with my config file (below). That's why I started searching the forum for similar errors

Code: Select all

<?php
# CMS Made Simple Configuration File
# Documentation: /doc/CMSMS_config_reference.pdf
#
$config['dbms'] = 'mysqli';
$config['db_hostname'] = 'removed';
$config['db_username'] = 'removed';
$config['db_password'] = 'removed';
$config['db_name'] = 'removed';
$config['db_prefix'] = 'cms_';
$config['timezone'] = 'America/New_York';
?>

[Dr.CSS]

How did you enable pretty URLs and did you use the htaccess.txt file from the doc folder..?

[fearmydesign]

How did you enable pretty URLs and did you use the htaccess.txt file from the doc folder..?

Hi Dr., yes I did use the htaccess file from the doc folder.

I did however fix this error. I don't really know what caused the error... all I did was delete everything including the database file. Then I uploaded everything again, and it worked fine.

Maybe a glitch while uploading the 1st time through FTP, not sure.

Thx