someone was able to upload php files without ftp access to my server

Question

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc were all secured. So I am wondering if someone can help that how that person would have been able to do this so that I can have it fixed. It is very critical for me to plugh this asap. Please help.

Answer 1

Either your FTP wasn't secured like you thought, or you have a upload script somewhere that has a vulnerability, or you have used some third-party code that is malicious.

Here are some examples...

1. FTP isn't secure. It is actually really quite easy to get user names and passwords for FTP accounts as they aren't encrypted. These days, we tend to switch off FTP until we need it available, or lock it down by more than just user name and password (i.e. IP address, SFTP etc).

2. If you have an "upload" page, you will need to check it for vulnerabilities. These include not requiring a log-in to use the upload page or having plain text user name and password for the login page and if you have the server-side destination as part of the form, people could change the value to publish files to other locations.

3. If you have used a free script, like a forum plugin or gallery - do you trust the source. It is a common malicious attack to make people upload a free script that does something that takes a while to write, but with added code that opens your site to attacks, such as writing files to the server or making pages available that allow attacks.