: How could this site have been infected? I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The index.php and index2.php files were overwritten, the administrator

@Murphy175

I've seen this a couple of times. It's not always possible to work out what has happened, but in several cases, a machine with the FTP details has been infected with some kind of malware/virus, that uses the FTP details to connect to the server and infect the machine.

Vote Up Vote Down

@Nimeshi995

There are several ways that an attacker could have gained access to the site. Here are some common possibilities:


The attacker gained access to the server via FTP or some other availabe publication/admin channel. Perhaps there is a weak password and access was gained through a brute force attack, or maybe through social engineering, the password was obtained. Check the server's security log (though the attacker may have had access to delete the log).
The web site may have XSS vulnerabilities or other code defects. For example, the code could be vulerable to SQL injection or PHP may be performing system calls formed with user data.
Joomla may have known vulnerabilities. Make sure any security updates are applied.


Good luck!

Vote Up Vote Down

@Carla537

You need to see your webserver logs. There you can find enough information about intrusion. It was hacked via web, and therefore all in apache (or another server which you use) logs

Vote Up Vote Down