Hacked - what do I do?

[stevelamb]

We've been hacked twice now in the last week. First time they added a new story on the home page - an anti-war message. The second time an anti-war message again, but this time replacing an existing story. How are they doing this and what can I do to stop it? We have .htaccess on our phpMyAdmin and we're not hosting ourselves - we use a web host.

We're using phpnuke 5.6 and have modified many parts of it so can't really upgrade.

thanks

[chatserv]

http://www.nukeforums.com/downloads/phpNuke_5.6/BUGS.txt

[stevelamb]

Hi

Thanks for quick reply.

Is it just that first bug fix, the change to line 35 in index.php? can you explain to me what it means?

thanks again

[chatserv]

The hack that was being used to alter site stories basically converted the $score variable into a sql command to alter story titles and content, adding a integer value check to the score variable attempts to make sure nothing besides a score value is used.