password_forgotten.php hacked?

Well, how to start?

I was working this morning when suddenly 350 bounced e-mails hit my inbox on my machine! I have my VPS server set to send bounced mail to my inbox. Contacted my host and they told me the offending file was "vs.php" that magically appeared in my /tempEP folder (which has 777 permissions). There was no evidence in my apache logs of this being done vis ftp.

So then I go digging into my zencart admin logs. I find a huge number of hits against "password_forgotten.php" ... this is how they must have got in as I don't know of any other way for them to gain admin access. No, my user/password isn't simple, but neither is it uber complex (is NOW!).

So, once in the admin, they used EasyPopulate to upload the "v2.php" file to my temp folder.

I did some more digging. Appears they were also using the "record companies" image upload to upload php files to my images folder.

I have removed the "password_forgotten.php" file from my server and am now going through my directories to clean things up.

Wish there was a way to run zencart without requiring "777" permissions for certain scripts to work correctly.

If you have any advice (I'll be going through the "recovering from hacks" material), I'm all ears.

Thanks
Chadd

In June 2009 all forum members were emailed about a very important admin security patch: http://www.zen-cart.com/forum/showthread.php?t=130161
Evidently you didn't apply that patch, and have been hacked as a result.
You'll need to patch your site and do all the requisite cleanup, some of which is discussed in the link above.

DrByte:

In June 2009 all forum members were emailed about a very important admin security patch: http://www.zen-cart.com/forum/showthread.php?t=130161
Evidently you didn't apply that patch, and have been hacked as a result.
You'll need to patch your site and do all the requisite cleanup, some of which is discussed in the link above.

Ouch! Chided by "da Boss"!!! LOL! But deservingly so... not an excuse but June/July were bad months for me and I can see me either missing the email entirely or not paying attention. Breaking up with my girl of 5 years was a bit all consuming.

Thank you for the reference info. I'll get on it.

Thank you!