Modx 1.0.5 Hacked

Hello,
I have installed modx 1.0.5 on a hostmonster server. And when i try yesterday to log-in at /manager the admin password was changed, so i realized that site have been hacked.
I have reset the admin pass but when i logged in the site was a mess. Databases where deleted.
Pages were deleted.
What may be the cause of this? sql injection? xss?

hi,

there may be a lot of reasons, most of them no due to modx... beginning with your hoster own security !
i’ve already been hacked a few times on some websites i was running and, getting in touch with the hackers (it’s often a good idea when they leave a contact even if a bit freaking i admint )once, they explained me they had used a security fail of the server kernel
another time, they explained me that the hoster root database passwords were not encrypted

something else that is quite useful for you to understand the causes is to get in touch with your hoster and, if they are honest (a lot of them are) ask them if you’re the only one in that case. If not, you could guess the problem isn’t modx

cheer up...

have swing

Also, possibly you have a trojan on your computer that captures logins and passwords and sends them off to the hacker.

The answer from the hoster:

Though we host your website, we are unable to manage security of your content. We have multiple safeguards in place to prevent our servers from being hacked, including prevention against brute force attacks and tight security on user accounts. The actual vulnerabilities a hacker uses to gain access to your home directory or public_html folder are often located in the scripts themselves. For this reason, we provide updates through SimpleScripts as they are made available, and also offer courtesy server backups and a backup utility in cPanel, which you can use to take partial or full snapshots of your account whenever you feel a need.

As to which script was exploited to allow access to your account, we would be uncertain what was used, as most exploits use standard pages in your account with unusually formed requests to inject their own content to your site. There are multiple resources online to help you identify the cause, and we would suggest starting with the authors of the software you are running, to see if there are known exploits or updates that the vendor is aware of.

Sounds to me like a carefully worded, standard issue "blanket denial." I would bet a dozen donuts it was a server exploit.

+ 1 with cyclissimo...

+1 with cyclissmo

I have found most hosting companies seam to shift the blame to the script(s), when in some cases the server is to blame. I am working with one client currently who was hacked twice on the same server. We just moved them and the site is not only running faster, but on a more secure server.

One quick test is what chmod do you use on files, if you can use 666 without any problems, then your host isn’t likely using phpsuexec (or similar), which affects security.

+1 with the guys,

a good host will make a good investigation with you
to find out what caused the hacked website and not just
send you a boilerplate letter saying it is your host.