One of my MODx domains has been hacked.

I just received an email from my provider saying:

This morning we receiving notification that the site sitename.com was hosting a phishing site (Bank of A). I chmod 600 the subdirectory hosting the site to make it unavailable.

The site was:
http://www.sitename.com/ssl/www.bankofamerica.com/securityupdate/trustupdater/sitekey-challenge-update/update.bankofamerica.com/index.htm

Normally when this kind of thing happens it’s almost always a breach of the CMS. As I told Michael, this may mean there is a patch or an update available. The site logs may contain more useful information, but I have not examined them as of yet.

What are the possiblities, and how would they get in? I haven’t done any work on the site for a few months.

I’m trying to retrieve the logs, and will keep you all posted.

Any thoughts from anyone?

You need to provide us with full details of your MODx version, server configuration, and snippets/plugins in your site definition. Feel free to PM me...

This looks like a cross-site scripting attack, and is likely being done to a vulnerable form or other dynamic snippet you have deployed within your site which accepts user input. Likely you simply need to make sure any user-input provided to this form removes any html tags before presenting the resulting page. It is also probable that this has nothing to do with the MODx core itself, and everything to do with a specific snippet/plugin you are utilizing in your MODx site.

Thanks for the quick reply.

I PM’ed you as many of the details as I could.

Thanks for your time!

Taff