phplinkdirectory admin panel hacked?

[John D]

Hey,
Before anyone starts jumping to conclusions this is a question, I don't know what has happened but it could be that phplinkdirectory was hacked.

I looked and that page has a 404.

I did a search on google and the only result was someone posting that one of their pages of IPB has about 20 frames pointing to that domain.

Does anyone know how it could have happened?

[DelMarSurf]

Hard to say - put a directory pw on your admin, templates, and any other files you have hanging around. You templates and install info are wide open right now.

[Boby]

You might want to read this thread before going again online:
http://www.phplinkdirectory.com/forum/showthread.php?t=2160

Make sure all files and folder except the temp/, temp/cache/ and temp/templates do not have writing permissions.

Boby

[John D]

Hey Boby,

I read over it but I can't see whats wrong.

I replaced all the template and admin folder files and protected the folders, but I am still seeing the same thing.

Thanks!

[chenxinhe]

permission 755 is secure or not ?
on my site many of the folders are 644 permission.

[John D]

I thought it was secure enough to use..a lot of scripts use it.

Anyone know is that might be the problem or its something else?
Really need to get this fixed, still can't submit sites or access the admin panel.

Thanks

[David]

What are the contents of /admin/index.php ?

[Boby]

Can you show us also your .htaccess?
Check if there are other htaccess files, maybe in /admin/.

Boby

[John D]

Thanks :)

admin.php

Content visible to registered users only.

.htaccess

Content visible to registered users only.

There's no .htaccess in the admin folder.

Hope this helps, thanks very much :)

[Boby]

Show us please /templates/admin/index.tpl and /templates/admin/main.tpl

Also check the javascripts in /admin/files/
I get this error in my javascript console (Firefox):
Content visible to registered users only.

If you don't mind, you can send me login detail to your FTP via PM and I will check your files.

[Boby]

I found the problem, your /include/config.php was defaced!
Someone added the iframe on the bottom of your file, because this is the file that is included on top of all other.

I haven't touched it, so you can check it on your own. You can see following code on the bottom of the file:
Content visible to registered users only.
Remove it! Change all your usernames and passwords, specially to the database, but all other too. Take a fresh copy of phpLD, who knows what else was touched.

And that is why I always say, drop writing permissions to config.php after the installation. And that's also why phpLD 3.0.4+ has an warning message in admin panel if the file is still writeable.

Boby