Hack of MODx 1.0.5 site

Hi,

We have received a warning of malicious content from Google, and while investigating we have found 3 files in the /assets folder named: map.html (contains an "injected" version of the front page), pigolig.php (some code compressed with eval(gzuncompress(base64_decode... ) and salemsia.php (uncompressed php code).

Can anyone tell me if this is a CMS hack/exploit, or is it a server hack (db, ftp or php) and how to cover it?

Thanks

Later edit: I cannot find any irregular link/code inside the pages, only the link from Google, which looks like ...assets/pigolig.php?q=pictures-of-alaskan-pollock

Hello,

It’s most likely the server (or your account) was compromised, and less that MODX was compromised. Who are you hosting with currently?

Sorry about the delay, I didn’t get an email about the reply. I don’t know the hosting provider, there’s a web admin that handles the server. After investigation, it seems like the old server and domain got hacked (tons of porn links injected), and somehow it tried to infect (unsuccessfully) the new domain/site built on MODx. The files remained after moving to the new server, as the web admin didn’t know they were not supposed to be there.

Anyway, thanks for the clarification about MODx’s safety. I knew it all along