Codezwiz >> Forums >> General PHP Nuke Help >> my site was hacked please help!!!

HELP ME ASAP PLEASE SOME carolers HACKED MY SITE!!!

//Edit: LINK REMOVED. REASON: DO NOT POST A LINK TO YOUR SITE WITHOUT A WARNING REGARDING THE SEXUAL CONTENT ON YOUR SITE! - KH

what files they could edit to do that i have no clue how they hacked it also
i run phpnuke 7.3 sec fixed

what to do

did you use a installer.? nukesql.php by any chance.? if you did delete it

nothing my site is online like 2 month now ;/ i didnt use no installers

You didn't actually mention the problem. Are you locked out of admin? Has everything been deleted? From looking at the site, all your news seems intact so that doesn't look wrong. Could you be more specific please?

those morons did some kind of sql injection worm i installed nukesentinel wich was suppose to protect my site and now they did it again the 1st time we fixed it...
what to do im desparate already from this phpnuke id move to phpfusion long ago but i dont wanna loose all my databses n stuff ;( what can i do to protect myself from sql injections and stuff? greetz kaktuz.com admin

Open your db/mysql.php and find the following section of code and replace with this. I don't believe Sentinal has this covered but not sure.

//
// Base query method
//
function sql_query($query = "", $transaction = FALSE)
{
   unset($this->query_result);
if ($query[0] == 'S') {
$query_parts = preg_split('/(union)([\s\ ]+)(all|distinct|select)/i', $query, -1, PREG_SPLIT_NO_EMPTY); //Security fix by Telli � 2002-2004 Codezwiz
if (count($query_parts) > 1) {
$query = '';
foreach($query_parts AS $part) {
if ($query != '') $query .= 'UNI0N SELECT';
$query .= $part;
}
}
}
$this->query_result = @mysql_query($query, $this->db_connect_id);
   if($this->query_result)
   {
      unset($this->row[$this->query_result]);
      unset($this->rowset[$this->query_result]);

      return $this->query_result;
   }
   else
   {

      return ( $transaction == END_TRANSACTION ) ? true : false;
   }
}

//
// Other query methods
//