hacker injecting code?

I was wondering if anyone could point me in the right direction.

I have a site that had code injected into every php file found in the manager folder (.96)

I upgraded to 1.0.3 and made sure I removed all injected code from non-updated files.

Today, the same thing happened again. Is there anyway to find out what was exploited by looking through the logs?

First, where are you hosted? Did you change your account/FTP password after the first injection occurred? A recent string of attacks against several hosts are exploiting vulnerabilities in one account to attack other accounts on the same shared server, FWIW.

Next, have you added any Extras to your 1.0.3 install? If so, which ones?

All passwords were changed after the first incident.

This is on a godaddy shared hosting environment (so it could be a another account that is the culprit)

as for extras, the following plugins are being used:

* Forgot Manager Login
* Inherit Parent Template
* ManagerManager
* TinyMCE Rich Text Editor
* Anchors Away
* Direct Resize
* Google Analytics

I have been having a lot of hosting problems so it may be time to change.

Thanks
Brian

GoDaddy is experiencing ongoing issues with this from what I understand. I can’t say that I’d expect anything less than what you’re experiencing.

That is definitely the host I am referring to. Out of curiosity, can you tell me if a) PHP is running as an apache module (would be Server API = Apache 2.0 Handler in phpinfo) and b) if open_basedir has a value in your phpinfo?

phpinfo:

Server API > CGI/FastCGI
open_basedir > no value

I just did a google search and it does appear godaddy is having issues with this.

They seem to blame it on outdated software even when the application is up to date.

Thank you for pointing me in the right direction.

From what I remember the last big attack on godaddy was blamed on wordpress, however is was proved to be the godaddy servers that were at fault.

They seem to be getting allot of attacks lately and blaming everyone but themselves which is very worrying for anyone that has sites hosted with them.

Look at the footer below, 2nd advert

Quote from: betoranaldi at Jun 09, 2010, 05:25 PM

phpinfo:

Server API > CGI/FastCGI
open_basedir > no value

One last question, is it running suexec? IOW, does PHP execute as the same user as your FTP user account or does it run as the webserver user (e.g. nobody, apache, www, etc.)? You can tell by who owns the page cache files in assets/cache/ for instance...

Owner/Group is set to some random number (not the username) so I am assuming it is running since "nobody" doesn’t own it.