server was hacked

[Erik Osterholm]

On Sat, Aug 11, 2007 at 07:20:31AM -0400, Brent wrote:
> a compromised mambo site. after getting rid of the program I changed
> our router to disallow this type of traffic..& started trying to fix
> the box. Im pretty sure that root wasnt compromised but im going to
> re-install anyway. my question has anyone run into this problem with
> CMS sites, HOw excatly are they getting in ?

Lots of CMS have long histories of vulnerabilities.  Check out
www.securityfocus.com e.g.
http://search.securityfocus.com/swsearch?query=mambo&sbm=bid&submit=Search%21&metaname=alldoc&sort=swishrank
for some details.


Erik