help! site was hacked, need to upgrade, not sure to what version....

OK, I’m running .9.6 (at least, that’s what it says -- I inherited this site). We just had a major incident which my server folks tell me was probably due to a vulnerability in my MODX installation. My bad for not upgrading, I know, but the site was working well and my client frowned on any downtime so I kept putting it off. Well, now they’re frowning even harder on the idea that this could happen again.

So, time to upgrade.

I see that to leap to Revolution from .9.6 is currently recommended only for "brave souls."
What would be recommended for timid souls?

I’ve got php 5.1.6.3, mysql 5.0.82 running on an apache server, centos 5

My site is not big but it is mission critical right now. I am not a MODX expert or a developer really at all, although I have a developer to help (he doesn’t have much modx experience either). Could you suggest the best upgrade solution for us now?
Thanks!!!!

There are various reasons why a site could be hacked. It’s not necessarily the software (CMS / script) itself, it could be also the hosting company’s weak overall server settings (at the Apache level already, and then again at PHP / mySQL level). A few infos about what exactly has happened would have been helpful.

I’d recommend to first of all backup everything, then upgrade to the latest Evo version (1.0.4. afaik).

After you’ve done that, it would be advisable to read up on vulnerabilities / possible hacks / injection attacks etc. in the forums. e.g. there was a search highlight plugin (or snippet) that was easily hackable (but then again - also easy to fix). Another well-known problem was a Ditto Reflect bug (fixed a long time ago). As a general rule of thumb: disable everything you don’t use / need, i.e. every snippet or plugin or module should be disabled rightaway.

If you encounter the same kinds of problems again with a fresh MODx upgrade, I’d recommend moving to another host.

well, it was a php/script injection issue....
anyway, latest Evo, ok, sounds good

Sounds reasonable re:disabling the things we don’t need, thanks!

And, yes, I will keep up to date on security issues on the forum from now on!!!

For upgrading and securing your site maybe these links will be helpful: http://4up2date.info/modx.html