My website is being hacked for the last 2 days. I'm an amateur who built it back in 2007ish and it still has some poor code. Was a hobby project that suddenly became very popular and lived to this day fluorishingly despite php5 and no prepared statements, just mysql (not mysqli) queries. Maybe that's the end of the line for it, but I got nothing to lose by asking for some help...
I do sanitize inputs, but inside user area there was at least 1 file that didn't do a good job and also echoed mysql_error back to user screen. And this Russian hacker took time to register and confirm email (so I have it now) to perform his SQL injection. (It's a Ukrainian website, with a few patriotic notes since invasion, maybe that p*sses somebody off because on May 9th there was a spike in hacking attempts I've seen on Cloudflare)
They were able to change passwords and a couple other fields in 1 table in database. (noticed couple hours later, changed those passwords, started investigating) User deletes his account right after he's finished. His IP points to cheap Russian hosting/vpn/data center (found their IP range, blocked with firewall only today).
Then in logs I see files used exclusively as includes being requested from 2 new IPs: 1 known in abusedb for apache-bow-document,php-url-fopen - (btw my php allow_url_fopen On allow_url_include Off) 2 'clean', from China, 'Data Center/Web Hosting/Transit'
No more observable changes (to me, that is) in database or website 48 hours later.
What I've done so far: fixed (hopefully) couple places where SQL injection was possible Changed FTP password, changed linux user password, been toggling shell access off/on. I need SFTP myself, much faster to navigate and change things, but if I disable shell it becomes impossible, right?
I don't know whether this all means they know mysql password or user password? They all different, and mysql user has minimal previlleges as far as I remember (tried running SHOW GRANTS FOR user as root but doesn't show anything maybe bc root has no database?) Any tips appreciated, really.
I've seen hacking attempts for years on this site, as in ?id=user&%OR%...Union... blah blah and they were never successful but this time somebody decided to target it seriously, I guess..
just ran SHOW GRANTS in phpmyadmin as user and it looks scary
GRANT USAGE ON . TO 'dbuser'@'localhost' IDENTIFIED BY PASSWORD 'blahblah' GRANT ALL PRIVILEGES ON mydatabase. TO 'dbuser'@'localhost' –
I guess I should change mysql user password and previlleges? Or too late... I thought they were minimal like select, alter, index, delete and drop. Sorry for long text)