Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

All Site passwords changed

Discussion in 'Security' started by wstream, Dec 4, 2013.

  1. wstream

    wstream Registered

    Joined:
    Dec 4, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi All

    I need some info and help

    We have a dedicated server witha handfull of joomla sites and 1 wordpress site.

    last night we had the wordpress site hacked.

    As a result all other sites that are joomla had their user table - user passwords chaged and privelages changed to superadmin.

    Whats puzzling me is how they were able to change passwords on other databases in the same server.

    At worst they could have got hold of the DB password for the wordpress database but not the others.

    so how would they have changed the data on the other db's

    In order to protect against this happening again ill need to determin the route taken.

    Any help or pointers greatly appreciated.

    Thanks

    Ash
     
    #1 wstream, Dec 4, 2013
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    42,727
    Likes Received:
    1,705
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    #2 cPanelMichael, Dec 4, 2013
  3. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,010
    Likes Received:
    87
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    You got hit with a symlink hack.

    http://forums.cpanel.net/f185/solutions-handling-symlink-attacks-202242.html

    In short, a hacker can use a default cPanel/WHM/Apache setup to get read access to everyones configuration.php files. With that they have all the SQL usernames/passwords to change the admin tables.

    I suggest cloudlinux with securelinks, or at least SuPHP with the EasyApache "Symlink Race Condition" protection.
     
    #3 quizknows, Dec 4, 2013
  4. wstream

    wstream Registered

    Joined:
    Dec 4, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi Michael - thanks for the move

    Quizknows - thanks for the reply - yup looks like thats what happened - have applied RUID2 and JailShell

    Thanks again guys

    Ash
     
    #4 wstream, Dec 5, 2013
(You must log in or sign up to post here.)
Loading...
Similar Threads - Site passwords changed
  1. cakka

    can't add .website in addon domain

    cakka, Apr 13, 2018, in forum: Bind / DNS / Nameserver Issues
    Replies:
    2
    Views:
    63
    cPanelLauren
    Apr 16, 2018 at 8:03 AM
  2. Marlon Mena

    public_html site not found

    Marlon Mena, Apr 8, 2018, in forum: General Discussion
    Replies:
    10
    Views:
    120
    cPanelMichael
    Apr 10, 2018
  3. schendra

    User overquota but still can upload file via website

    schendra, Apr 8, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    43
    cPanelMichael
    Apr 10, 2018
  4. ebbx

    Restoring website from backup issue

    ebbx, Apr 5, 2018, in forum: Data Protection
    Replies:
    6
    Views:
    94
    cPanelLauren
    Apr 6, 2018
  5. Xavier Crespin

    Unwanted HTTP Auth on website

    Xavier Crespin, Apr 4, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    52
    cPanelLauren
    Apr 16, 2018 at 7:35 AM

Share This Page