1

My site was hacked by a Russian hacker. I know because the characters were Russian on one of the files he left. I have cleaned up the site, but many of the links are looping back to the home page. What can I do to fix this? Thanks

I have Craft 2.3, php 7.1, mysql, and here is the site: camp.gsnorcal.org

Appreciate your feedback

1
  • 1
    You seem to know a lot about this hacker based on just a few characters left behind...? It’s most likely an automated script that managed to penetrate the site. Follow @4midori’s advice and upgrade to a supported version of Craft.
    – Ben Croker
    Commented Dec 6, 2023 at 1:20

1 Answer 1

3

There was a bug in Craft 4 mentioning RCE vulnerabilities, and I saw the same results of hacking on my site(s), but I'm not sure about such an old version of Craft.

Can you restore the site from a previous database backup? You will need to find a backup that predates the hack. After that, I would suggest:

  • Upgrade to the latest point release for Craft 2, better yet, make a plan to upgrade all the way to Craft version 4.
  • Reset all user passwords, and review all permissions and delete all unneeded accounts

Maybe others can chime in here with additional security suggestions.

1
  • Agreed. Craft 2 hasn’t been updated in over 3 years and Craft 2.3 is over 8 years old.
    – Ben Croker
    Commented Dec 6, 2023 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.