ModX Evo Spam Link Injection on the button of the page. [solved with questions]

Hello ModX people, My story has a quick solution but needs help!

Google Webmaster tools shows me this:



I have been having problems with spam links injection on 7 of my ModX (Evo 1.0.4/1.0.6/1.0.7) sites, some one hacked the sites and put something like this, on the bottom of every page!



Investigating about this problem and based on this really helpful web: http://d43.me/blog/1697/modx-evolution-removing-spam-links/

They said that you need to go to the database and delete a chunk of code and this will solve the problem, that was Excellent, BUT i was checking the plugin Quick ManagerManager and this plugin should not exist, that means that SOME ONE PUT THE PLUGIN IN MY PAGE WITHOUT MY PERMISSION, the question is HOW?.

I compared it with a fresh ModX installation, and i realised that this is not part of the system, but i found a quicker way to solve the spam link injection problem, without going to the database.



HOW TO SOLVE THE PROBLEM?: You just need Disable the Plugin or delete it and the spam injected links will disappear from the code.

But the Big question is: HOW DO THEY DO THAT AND HOW CAN I SOLVE IT? because that is a huge security problem.
and right now i don't know for how long this fix will work.

My passwords in every database, ModX user, FTP, etc... are very strong and complex, but it is obvious that they are not working...
Any ideas guys, i think this is a concern to everyone, we all are vulnerable to this hack.

Thank you very much! [ed. note: Ysanmiguel last edited this post 13 years, 4 months ago.]

There is a vulnerability in the Forgot Password function of Evo prior to 1.0.8 or so (not sure exactly when that was fully patched) that allows hackers to give themselves access to the Manager, at which point they can install anything they want.