Looks Like I got hacked or there is a issue?

[Freespirit]

Hi Friends,

Seems all my categories have been set to Arabic and can't be changed anymore...

Site is Clicksnow.eu

Screenshot added... could anyone help me getting this resolved....

Robert

[Aficionado]

Hacked ? I don't think so.

Why a hacker change the categories to arabic ? Also why hack an EMPTY site ?

It doesn't make any sense.

Also what do you mean "you can't change them anymore" ? Is there an error or what ? Enable Debug.log and check.

[Freespirit]

Ok, your right don't make sense why Hack the site who knows what people think...

But, there is no error :-( I go in the back-end and change the LANGUAGE to English it say saved and nothing happens in the front panel... then I go back to the admin and it's Arabic again..

Robert

[WEBmods]

Ok, your right don't make sense why Hack the site who knows what people think...

But, there is no error :-( I go in the back-end and change the LANGUAGE to English it say saved and nothing happens in the front panel... then I go back to the admin and it's Arabic again..

Robert

Hello,

This could mean that there's an error when inserting preference in the database.

Enable these and check for errors:
https://doc.osclass.org/Debug_PHP_errors
https://doc.osclass.org/Debug_SQL_queries

Regards.

[Aficionado]

Ok, your right don't make sense why Hack the site who knows what people think...

But, there is no error :-( I go in the back-end and change the LANGUAGE to English it say saved and nothing happens in the front panel... then I go back to the admin and it's Arabic again..

Robert

Well again is it strange since LANGUAGE is for the "interface" and not for Categories / Subcatsegories. Catagories only change if somebody changes them manually.

Also the categories ONLY are arabic or the whole site as you say ? Because i see no Arabic as Language visiting your url.

[Freespirit]

yes...

[Aficionado]

yes...

https://doc.osclass.org/Debug_PHP_errors

Enable that to a LOG.

[Freespirit]

Ok, Added a file queries log...

[Aficionado]

Ok, Added a file queries log...

Better add also the PHP debug log ....

[Freespirit]

the debug file is still empty... tried making change activating the languages etc... still empty

Robert

[dev101]

Hi,
if you think, suspect or believe that you are hacked, do the following:

1. zip your entire osclass directory, all the files, everything, from the cPanel's file manager
2. export your database
3. if you have backups, go to your cPanel > backups and try to download version that was fine.

Now, send all those files (rename them accordingly) or upload them somewhere and share the links with Osclass Team: sistemas @ osclass.org

* * *

Now, try to recall your steps, what you did, maybe installed some plugin? Unintentionally changed something? I know it's low probability, but just to make it sure.

* * *

Regards
dev101

[Aficionado]

Could it be that someone else had Admin access and did all this ?

[Freespirit]

Hi dev101,

Thanks for the feedback, I send a email with like for the files of the site and DB...

and No I am the only admin.. :-(

Robert

[dev101]

Not sure, really. In any case, the reason why I wrote above is because it is always a good idea to have all versions offline (both good & compromised/bad ones).

Now, if the files are really huge, it may take forever to generate them and download and upload / email them later, and many email servers have limitations of maximum file size. So, in that case you may also ask someone from Osclass team to take a look, with given full access to your server, as that is the fastest option.

I'm writing all this, because, most users just panic and quickly restore their backups, loosing potential valuable insight about the breach (if any).

Until then, I can's say more.

Regards

[Aficionado]

This not a hacked site. All those Arabic categories are the correct translation. Sale, Vehicles.

No hacker will do that.

Something else happened.