My MaxiGallery got hacked!

Just an FYI to everyone, I am running 0.9.6 and using Maxigallery for the image gallery. I had to set the assets/galleries/ folders to 777 as per the install instructions and the site got hacked and then the hacker setup some phishing stuff in those folders. I found all this out through the client who found our from the host. It was really a bad deal.

Anyway, any ideas on how to have those folders be set at 775 and have the gallery still be able to upload images?

Thanks

Are you sure it was maxigallery which got hacked, there has been a recent exploit with reflect snippet.

It might be worth while checking your website for any new php files and also make sure you have register_globals = off.

Aaron

I second the opinion that it is more likely to have been the issue in the recent security notice. It is also a good idea to subscribe to the security notice feed (which shows in a tab in the manager in recent releases of modx).

I am not very familiar with the reflect snippet. I did delete the file they talked about deleting: snippet.reflect.php and I have turned register globals to off. Do you think this will protect against future attacks? Is it safe to change my assets/images or assets/gallery folder back to 777?

Thanks

I would give as little permission as you can as why give more than is needed.

Some hosts use phpsuec so you can use 644/755 permissions (files/folders) which in my mind gives better protection, but different hosts have different setups so use what works for you.

AMDbuilder

you also better transfer back all files to a clean PC and scan the tree with an antivirus.
Hackers post extra files with "look like almost normal" name in some directories (media forinstance)

And you should give a look to all index.php file (date, especially if its something around 25 Nov) as my sites hacked through the reflect issue have seen some index change (iframe added to do ..something )

Regards