0

I previous asked this question on StackOverflow. I was recommended here for help. There are some more details on that question.

Someone has somehow gained unauthorized access to my website. They have been changing the PHP source code of the site to inject Google ads. My database and other sites on the hosting plan seem unaffected, though I have everything backed up just in case they are able to get deeper access.

The site is hosted on a shared hosting, It's coded in PHP (version 7.4) and running under Apache.

The hosting provider was not helpful. The recommended changing my passwords (which I had already done: FTP, CPanel, and hosting account passwords). They claim they don't have any logs on the system to check. The ads are still being re-inserted into the code every time I remove them.

The injected code is different every time, and does not appear to be computer-generated, so I am certain the changes are being made by an actual human with access to the system, not malware.

At the recommendation of one of the StackOverflow answers, I am scanning the site for vulnerabilities with Arachni. That scan has been running for about an hour and a half and is still going, but so far nothing helpful has surfaced there.

I need to figure out how the attacker is gaining access to change my source code. I'm out of ideas for places to look. How can I detect how the attacker is accessing the server so I can shut them out?

3
  • In most cases you need to hire a security consultant for that (review your code, as well as review configuration associated). This isn't something any online forum can offer.
    – Lex Li
    Jul 21, 2020 at 23:34
  • Hi, cPanel question are offtopic, but I choosed that canonical, as it show that your hoster got step to do if it’s not a problems with a lost password or your code. As such it’s a good test to know if your hoster know what he do, and if you want to continue with them.
    – yagmoth555
    Jul 22, 2020 at 0:15
  • If its more a topic for cPanel please know the sister site webmasters.stackexchange.com will gladly help
    – yagmoth555
    Jul 22, 2020 at 0:17

1 Answer 1

1

Likely your PHP code is vulnerable to PHP Code Injection. See link for a trivial example. As Lex Li suggests - independent review of your code is the next step.

Not the answer you're looking for? Browse other questions tagged or ask your own question.