HELP!!! My Clients website Deposit details changed to fake details by scammer
Please i need help with this issue.
my client website deposit details keep getting changed by an unknown person.
i have try changing password and also removing the edit option on the admindepositcontroller.php but yet,
the scammer was still able to login and change the deposit details to his own in other to stold money.
Please is there anyway to know where or how this scammer is getting access to the deposit details and changing it to his own?
I have changed the cpanel login details and still the scammer is still able to edit deposit details.
Please i need urgent help with this as my client is super mad at me because am the one that developed the site for him,
I have super limited knownledge on how php/laravel work, but i will be more than greatful if any guru here can help me fix this as am very worried.
For the full copyright and license information, please view the LICENSE
file that was distributed with this source code.
*/
eval('?>' . \file_get_contents('php://stdin'));
in this folder /home/bitcwlbc/public_html/projectname/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
am not sure what that means or which script its trying to call... am suggesting that this scammer is the develo[er that code the script as other user has accused him of putting/manipulating the script fromhis end after you install it just to extrack money from his buyers and people using his scripts.
There seems to be a remote code execution vulnerability in PHP unit.
This library should not be installed on your production machine. I guess because you use shared hosting you just copied your entire project to the host?
You should be uploading a version of the application that used composer install --no-dev to create the deployment image
The vulnerability also requires that the Vendor folder is publicly accessible, so if you have not installed Laravel correctly you are compounding the problem.
Only the contents of the public folder should be available to the outside world.
Shit. Sorry to hear that. Maybe best thing to do is to migrate to some more secure hosting setup
@bugsysha This sounds more like a poorly-coded application rather than the host. There's clearly some code that is vulnerable to attack. Moving hosts isn't going to fix that if that is indeed the issue.
If you have forms on your site, make sure they are protected against CSRF attacks. Laravel by default will guard you against this. However, it may be possible this has been disabled.
There are many folders in public_html/vendor that are installed by default with Laravel but most of them are not really needed.
Which ones should we really keep for common use. I know it all varies from the application type but some are problematic like eval-stdin.php as we had similar issue and our server was compromised because we did not delete this from the vendor folder.
