Server hacked by single website

[SimonrFrance]

Sir,

We are running updated version of cpanel/whm. I have a question, How hacker can hack whole server by hacking single joomla website (old version)?

I undersatnd he can hack CMS, so he should access only to this account files.
So how he got whole server access? all other website access?

Your reply will be appreciated. Thanks

Regards,
Simon

 

[quietFinn]

So how he got whole server access? all other website access?

Do you mean access to other websites, or root access?

 

[SimonrFrance]

Hi,

Hacker got access to other wesbites.
Don't know about root access.

Regards,
FHS

 

[quietFinn]

Maybe this way?
http://forums.cpanel.net/f185/how-prevent-creating-symbolic-links-non-root-users-202242.html

 

[SimonrFrance]

Thanks i am checking it.

 

[Jeff Shotnik]

I highly recommend that you use the patch Steven at rack911 created to protect against cross account symlinks - https://forums.cpanel.net/f185/how-...inks-non-root-users-202242-p4.html#post996441 . Adjusting your httpd.conf to disable symlinks if owners don't match can be easily overwritten with a .htaccess file.