Evo 1.0.4 index files hacked with iframe

Having had an Evo 1.0.4 hacked twice in a week (all index.php and index.html files changed to include an iframe) I was wondering if there is a fix for this for Evo 1.0.4 users:

http://modxcms.com/forums/index.php/topic,60451.0.html

As yet I’ve not been able to determine my site’s vunerability so the SQL Injection and Directory Traversal Vulnerabities might be totally unrelated. However, if there is a fix that I could apply at least it would rule it out.

It’s hard to tell how you got hacked, but upgrading to 1.0.5 is considered mandatory so that you’re not leaving yourself open to known vulnerabilities in 1.0.4. (It’s not actually a question of whether you are vulnerable to those ones.. you are!)
I have also seen iframe attacks come from other vectors on a shared hosting system.. a forum or blogging system for example; it can be very hard to track down.
My only other advice at this time is to keep stuff backed up!

Thanks netProphET, unfortunately I’m having to wait until the release of 1.0.6 before I can update as 1.0.5 crashed the site as badly as the hack. The same applies to all my 1.0.4 sites which is far from ideal.

Yes I’ll have to back up the database more regularly.

If you are able to run 1.0.4 you should be fine running 1.0.5. What kind of error messages did you get with 1.0.5? Can you try a fresh install to see if the issue is upgrade related or server related?

I’ve had no problems upgrading my sites to 1.0.5.

Sorry AMDbuilder I should have been a bit more specific. I use a TV with @INHERIT bindings to control my sidebar, this caused a PHP Fatal Error for me with 1.0.5. See:

http://modxcms.com/forums/index.php/topic,60199.0.html

After installing 1.0.5 I downgraded to 1.0.4 and my site worked fine again. Given that I’m one of the only people affected it’s probably a combination of changes in 1.0.5 and poor coding on my behalf.

Had similiar situation with one site some time ago. Remember to change your FTP password. This types of hacks are often related to trojans on computer stealing FTP account data from FTP client. Maybe scanning your machine for that won’t be a bad idea.