We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be coming from?

Someone/bot recently accessed our server & when we tried to access the website we were directed to an Adminer login screen. We rolled back to an earlier version of the website prior to the attack & things seem to be fine now - but I'm worried about these cookies. Is there a way to tell if our database has been corrupted in some way?

We're running the latest version of WordPress 5.2.3; Server architecture Linux: 2.6.32-954.3.5.lve1.4.63.el6.x86_64 x86_64; Web server: Apache; PHP version: 7.2.21.

  • In what way did someone access your server? Sep 23 '19 at 22:11
  • 3
    I wouldn't be worried about the cookies - I would be far more worried about what the person might have done with access to your server. There are a million ways to install backdoors that you will never find. So the only real question here is whether or not you have been hacked. I can't quite tell from your description. Installing Adminer is a strange choice for a hacker and more like something someone in your organization might do without properly communicating it Sep 23 '19 at 22:14
  • 1
    Finally, is the server asking you to set these cookies or is your browser simply passing them back up? Once set your browser will continue to send the cookies until they expire, regardless of whether or not the server may be using them. Sep 23 '19 at 22:27
  • 1
    Open a request to your browser in incognito mode and check for the cookies, as @ConorMancone alluded to they're probably not being set on each request
    – LTPCGO
    Sep 24 '19 at 1:12
  • Malicious/phishing files appeared on the server - we were alerted by a security plugin & Google Search Console. I only just now realized that the cookies were set on the day that the files appeared on the server - & deleted them & they do not seem to be reappearing. There's no way to scan our database for potential backdoors?
    – megseoh
    Sep 24 '19 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.