[website php error 500] after Plesk 12.0.18, update on 25 Dec 2015

[wsi]

Hello,

Since the 25 December 2015 I am facing a global error 500 on a joomla site.

Nothing has been changed on the structure of the site on that day. But for some reason, the site stop running with an error 500 display on all web browser.

I did contact the hosting support, and they did not really help, apart from control the connection and open gate to the machine.

Here is the result:

php version 5.4
Starting Nmap 5.00 ( http://nmap.org ) at 2015-12-28 09:57 CET
Interesting ports on mydomaine.com:
Not shown: 986 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
106/tcp open pop3pw
110/tcp open pop3
111/tcp open rpcbind
143/tcp open imap
443/tcp open https
465/tcp open smtps
993/tcp open imaps
995/tcp open pop3s
3306/tcp open mysql
8443/tcp open https-alt

Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds


Then on my side I did some check:

- Access to Cpanel du server (plesk) --> OK
- Restart (server: soft restart and hard reset) --> OK
- Manually « stop » and « start » Apache service --> OK
- Check the .htaccess (renamed .htaccess-test to see the result) --> OK
- Check over chmod 755 files --> OK
- Check over limit memory size php.ini (64 Mb) --> OK
- I do have access to the db via Mysql --> OK
- Check over configuration Joomla access db --> OK

Still the error remained after all this.
I do have bit of knowledge on Plesk but troubleshoot is something else.

I notice an update to Plesk: 12.0.18 on the 25 December 2015 on the Cpanel,

"12.0.18 Update #73, last updated at Dec 25, 2015 06:27 AM "
So, maybe or maybe not could be the cause of my issue.

Here is some samples errors logs getting right after the update:

[Fri Dec 25 06:32:05 2015] [warn] [client 66.249.64.131] mod_fcgid: stderr: PHP Notice: Undefined index: HTTP_X_FORWARDED_FOR in /var/www/vhosts/mydomaine.com/httpdocs/includes/defines.php

[Fri Dec 25 06:32:05 2015] [warn] [client 66.249.64.131] mod_fcgid: stderr: PHP Notice: Undefined index: HTTP_X_FORWARDED_FOR in /var/www/vhosts/mydomaine.com/httpdocs/includes/framework.php

[Fri Dec 25 06:32:05 2015] [warn] [client 66.249.64.131] mod_fcgid: stderr: PHP Warning: curl_setopt(): CURLOPT_FOLLOWLOCATION cannot be activated when an open_basedir is set in /var/www/vhosts/mydomaine.com/httpdocs/modules/mod_YYY/helper.php


I also notice 2 errors on plesk logs:

2015/12/28 10:17:37 [error] 2336#0: *4 open() "/opt/psa/admin/htdocs/robots.txt" failed
2015/12/28 10:17:38 [error] 2336#0: *5 open() "/opt/psa/admin/htdocs/sitemap.xml" failed

I have check on those 2 files, they are not present in this folder.
it could be nothing important...

Well, I’m lost and have no idea what to do to solve the issue.

Please help!

Thank you in advance.
Will.xxx

 

[wsi]

Hello,
I 've solved my issue.

I 've tried various solutions, but finally log a ticket and call the support.

Very helpful inded. They have not solved the issue but gave me enough details to find out and correct the problem.
So; Plesk running fine as well I my server.

The issue was: I have been hacked on that date, and it turned out to be just on same date as the Plesk update.

What I found: is some malicious scripts inject into my index.php with other impacted files into the include folder.
Using an old site backup to compare files (MD5 Checksum) and trace each errors in all logs files.
I corrected and removed all suspicious scripts to get the site back online.

(Files's dates of hacked ones, was remain to my last modification and not on updated to 25 Dec.)

Will.xx