I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The
index2.php files were overwritten, the administrator account had its password changed, and the
images folder contained a probably malicious executable file.
I was able to restore the
index pages with a backup and reset the admin user with another privileged user account.
As I'm not that much of an expert in these things, my question is: How could this site have been infected? Like in: How was it possible to actually delete and replace certain files and store an executable in a folder. How could someone change the admin password, but leave the rest untouched?
(I am very aware of the importance of installing core version updates - I am more interested in how such an attack could have been executed.)
Thank you for any insightful answer.