Security vulnerability?

[gkrehbiel]

A hacking script and phishing files were recently created under the shopsite web directory on our server.

Has anyone else been hit by a hack?

I’m trying to determine if there is a vulnerability in the shopsite program or if it is a remnant of a previous hack through an old version vBulletin forums software that was running.

We're running ShopSite Pro 10 sp2 r2.

[Jim]

We haven't had reports of any hacking on other ShopSite stores.
What directory were the files in - the output directory, ss cgi directory, sc cgi directory etc.

[gkrehbiel]

In the output directory.

[robm]

Have your web host check the FTP logs for these filenames. Often times these scripts are uploaded via a hacker that has obtained your FTP information.

If your forum/blog software is not at the latest version, upgrade them asap. Also check any "777" directory in your account for malicious files, as hackers often place one file that can then be accessed to upload other files, make changes, send spam, etc...

If you look at the timestamp of the malicious file, check your web access log for this exact time and search for a "POST" status to see if the hackers used a file in your web space to manipulate files in your account.

It's very doubtful they used ShopSite to upload these files. We have not seen this happen in our 15+ years of hosting.

Rob