an xt-commerce-based online shop from a friend of mine got hacked recently. The attacker mailed that the shop is vulnerable, he showed the extracted data (basically he dumped the databases and cracked the md5 hashes, which were not salted) and asked for some bitcoins.
My friend engaged a security company, which performed a (rather bad) webapp scan using accunetix web scanner. The output was almost unreadable as it contained almost 98% false positives (spread over some 40-50 pdf pages). So he asked me to perform a second scan and I found 4-5 SQL injections and some XSS, an outdated version of Apache as well as PHP and MySQL. The SQL injections were patched and I verified the patches, as I couldnt perform any SQLi anymore.
Now, the users of the shop were informed about the breach and were asked to change their password. However, some hours ago, the hacker managed to place a fake order in xt-commerce.
I wonder what the owners of the shop could do now?
- The did not enable MySQL logging as this would fill memory quickly.
- I asked them to inspect the Apache logs to see what happened during the point of time were the fake order was placed.
- I asked them to look for PHP/Web-Shells, which might have been placed on the webserver.
- I wonder if it is possible to somehow scan the contents of the database for abnormalities?
- Of course there is the possibility of still having security holes in the web app.
- If the attacker chose to exploit the webserver, php-daemon or the mysql server, we would have a hard time to trace this back, right? Should we thus turn on filesystem logging?
Could you suggest me what further steps to take or maybe just tell me your gut feeling about this situation?