Linked Questions

0
votes
1answer
721 views

Drupal site is compromised by backdoor [duplicate]

My Drupal site has been compromised. Although I applied all modules updates and update my Drupal core to 7.35, it is still compromised. What would the next logical step to take be?
2
votes
1answer
180 views

My site is hacked [duplicate]

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code: $sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
0
votes
1answer
122 views

Compromised D7 Sites due to SQL Injection Security Bug “Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003” [duplicate]

I have few websites running Drupal 7 and i upgraded them all on 16th October 2014. Since 3 days we are monitoring the websites and we haven't seen any problem or evidence of our system being ...
0
votes
1answer
103 views

Has my site been compromised? [duplicate]

Edit apparently they belong in the includes folder, were they also are. could it be of any use for a hacker to have these two folders in the root? I've been checking my drupal site and noticed in the ...
1
vote
0answers
50 views

Attack Script on my site [duplicate]

I am facing some serious issues with my drupal 7 site and i dont know how to solve it. For the past five weeks there is this particular script that is automatically injected into the html.tpl.php file....
1
vote
0answers
42 views

How to find backdoor that is adding code in my /includes/theme.inc file? [duplicate]

I got a "site may be hacked" warning from Google in one of my Drupal sites and while working to resolve this, I noticed that a hacker gained access to the /includes/theme.inc folder and added codes ...
0
votes
0answers
41 views

Finding the hole in a compromised site with a bunch of suspicious PHP files in /files folder [duplicate]

I was debugging a drupal 7 site and noticed that the /files folder contained a bunch of .php files with the following code: It looks like the code is encrypting and gzipping the file that it wants to ...
0
votes
0answers
32 views

Is my Drupal website hacked? [duplicate]

So I am running this Drupal 7 website, I just checked users list and got surprised with this: As you can see the usernames are spam and their emails are also spam. But I do not get it how they did ...
0
votes
0answers
28 views

All the sudden my site show rare characters and links doesn't work.Help [duplicate]

All the sudden my site (drupal 7) shows rare characters like �0�1�0� Also, the links doesn't work. All links in the site reload the home page. I can't access example.com/user neither. Please help. ...
0
votes
0answers
27 views

Front page full of invisible spam links [duplicate]

This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites. It looks to me that they are hard coded but i have no idea where to delete ...
1
vote
0answers
19 views

site hacked: ctolls cercoincontri [duplicate]

one of the web site (in Drupal 7.43) I am looking after (apparently not that well, although updates have always been applied) has been hacked. There's now extra text in the footer pointing to an ...
1
vote
0answers
14 views

Auditing my D7 Site after upgrade to 7.32 w/ Zen [duplicate]

As a security nut case, I should have taken the last Drupal Core security update seriously. I did not, as we're in the process of building a brand new version of the website, and were planning on ...
33
votes
6answers
9k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git a/includes/database/...
9
votes
4answers
5k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...
2
votes
2answers
3k views

Drupal Sending tons of Spam email

Apparently one of the modules installed on my drupal site has been sending SPAM emails from my server as in (name)_(lastname)@(myservername).com , it managed to send 1000 email and queue 97,000 emails ...

15 30 50 per page