0.9.6.2 security problem with reflect snippets

Please take a look through the security notices here and you’ll find all the info you need. It’s not necessary to uninstall the Reflect snippet, since the installed code is perfectly safe. You should, however, delete assets/snippets/reflect/snippet.reflect.php (or rename it to have a .txt extension), which is the code that was provided to be copied and pasted into the manager and is not needed for Reflect to run, and you also should make sure that register_globals is OFF.

If you’ve already been hacked, I suggest that you delete all of the files on the server and reinstall from a backup (use the new 0.9.6.3 installer to start and then copy your image and other files). Change all of your passwords (FTP, Control Panel, database, and MODx). And did I mention making sure that register_globals is set to OFF?

My site was hacked in the same way as it seems. My provider sent me an Email with a link to this thread.
Good service.

But when I look at the reflect folder I can’t see that file: snippet.reflect.php
So I’m a bit clueless of what I should do now. Should I rename all the other files in the directory (recursively) or is this pointless?

May be they already deleted the file for you?

Quote from: zi at Mar 18, 2009, 01:32 PM

May be they already deleted the file for you?

I think so. So do I have to do something else to be quite invulnerable to this exploit?
Or is there no danger any more?

Quote from: amayr at Mar 18, 2009, 04:08 PM

I think so. So do I have to do something else to be quite invulnerable to this exploit?
Or is there no danger any more?

The fact that you were hacked means you have register_globals enabled, so there is still danger, just not from this particular known exploit.

Unfortunately my provider won’t turn register_globals off, so I have to hope nothing happens.

Quote from: amayr at Apr 01, 2009, 12:48 PM

Unfortunately my provider won’t turn register_globals off, so I have to hope nothing happens.

If your provider won’t turn register_globals off, you have to find another provider.

Unfortunately my provider won’t turn register_globals off, so I have to hope nothing happens.

Than you can force that all your files be treated as PHP 5 files(your provider should have PHP5 support).
add this to your ht access file

AddType x-mapp-php5 .php

Is that applying to all hosts?

How does treating files as PHP5 solve the register globals being on issue?