Hacking using HORDE!

[NizzyG]

My hosting company just notified that my server was used for hacking other servers. It was a denial of service attack. I was asked to look into logs and investigate it.

I found out that Horde is the one used for that. if you enabled the Horde as I did and never secured the directory, etc, your server is under watch by hackers as well. Here is the link of that application can be called from.

Basically, horde allows users to run any shell commands. Horde has php shell, sql shell as well as CLI. How nice it is! go figure it out the rest by yourself.

http://www.SITE.com/horde/admin/cmdshell.php

I strongly recommend Plesk to remove the horde from their recommended list of applications.

 

[IgorG]

Thank you for notification. I have forwarded it to developers. I will update this thread with any useful information as soon as I receive it.

 

[m0rpheu5]

any news about that?

 

[IgorG]

Still under developer's investigation. They are prepare 9.5 release now, therefore not sure that investigation will be fast.

 

[IgorG]

Could you please, specify OS, Plesk version and steps to reproduce the issue.