Plugin Hacked

  • Dear Support Team,

    Recently this plugin was hacked and one of my test site is effected. My website is redirected to some spam link when someone visits. I try to found different solution but when I deleted my plugin, website comes backs. Before deleted, I found one entry in Database file with spam link, when I deleted this plugin, this spam links also removed that. I need an honest advice, What I have to do.

    My website is comprised, so what I have to do to ensure my website is 100% secure. I do not have any backup. I try ninja scanner, but its did not scan completed. Please guide me, so that I can cross-check everything to ensure a safe side. Also, guide me which things in website is comprised other than Database. Thanks in advance

Viewing 1 replies (of 1 total)
  • Anonymous User 17880307

    (@anonymized-17880307)

    The latest available version should be secure.

    You can manually update it or reinstall the plugin or make a password protection (.htpasswd) for the website, update the plugin and then disable this protection again.

    See the recommended steps in the first comment by legalweb at https://www.ads-software.com/support/topic/weiterleitung-redirects/

    The entry in the database should be the only code which causes this since this was a Stored XSS (Cross-Site Scripting) vulnerability. No additional files or database entries were affected.

    NinjaScanner mostly scans the files, not the database contents. Also a “redirect code” itself does not look malicious to NinjaScanner.

    To prevent such cases in the future I recommend to use NinjaFirewall (from the same developers) and enable its Full WAF Mode as this will block similar attacks quite well. But since the latest version of the plugin here should be safe, this specific vulnerability should be patched now.

Viewing 1 replies (of 1 total)
  • The topic ‘Plugin Hacked’ is closed to new replies.

Tags