Take the 2-minute tour ×

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc were all secured. So I am wondering if someone can help that how that person would have been able to do this so that I can have it fixed. It is very critical for me to plugh this asap. Please help.

share|improve this question

migrated from stackoverflow.com Jun 17 '11 at 13:46

This question came from our site for professional and enthusiast programmers.

We are going to need far greater detail than what you have given us to even begin speculating what could have caused the breach. –  Petey B Jun 16 '11 at 13:29

1 Answer 1

Either your FTP wasn't secured like you thought, or you have a upload script somewhere that has a vulnerability, or you have used some third-party code that is malicious.

Here are some examples...

  1. FTP isn't secure. It is actually really quite easy to get user names and passwords for FTP accounts as they aren't encrypted. These days, we tend to switch off FTP until we need it available, or lock it down by more than just user name and password (i.e. IP address, SFTP etc).

  2. If you have an "upload" page, you will need to check it for vulnerabilities. These include not requiring a log-in to use the upload page or having plain text user name and password for the login page and if you have the server-side destination as part of the form, people could change the value to publish files to other locations.

  3. If you have used a free script, like a forum plugin or gallery - do you trust the source. It is a common malicious attack to make people upload a free script that does something that takes a while to write, but with added code that opens your site to attacks, such as writing files to the server or making pages available that allow attacks.

share|improve this answer

Your Answer

