I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The index.php
and index2.php
files were overwritten, the administrator account had its password changed, and the images
folder contained a probably malicious executable file.
I was able to restore the index
pages with a backup and reset the admin user with another privileged user account.
As I'm not that much of an expert in these things, my question is: How could this site have been infected? Like in: How was it possible to actually delete and replace certain files and store an executable in a folder. How could someone change the admin password, but leave the rest untouched?
(I am very aware of the importance of installing core version updates - I am more interested in how such an attack could have been executed.)
Thank you for any insightful answer.