Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I own a content publishing website developed using CakePHP(tm) v 2.1.2 and 5.1.63 MySQL. It was developed by a freelance developer who kept remote access to the database which I wasn’t aware of. One day he accessed to the site and overwrote all the data. After the attack, my hosting provider disabled the remote access to our database and changed the password. But somehow he accessed the site database again and overwrote some information. We’ve managed to stop the attack second time by taking the site down immediately. But now we’re suspecting that he’ll attack again.

What we could identified that he’s running a query and changing every information from the database in matter of a sec.

Is there any possible way to detect the way he’s accessing our database without remote access or knowing our Cpanel password? Or to identify whether he has left something inside the site that granting him access to our database?

share|improve this question
add comment

1 Answer

Do you have multiple accounts for the database and did you reset the passwords for them all? Perhaps he made himself a second account to utilise that you haven't spotted?

Next on the list would be something like a SQL Injection vulnerability in one of your sites that he was aware of and is exploiting. For that to be the case though, the credentials in the code would have to be valid which takes me back to my first point.

I assume that when you mention speaking with your host that he doesn't have physical access to the host server? If he has that, there probably isn't much you can do remotely.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.