Here,
I have a new issue! Recently we got hacked, well our website didnt show any signs of hacking but I noticed that some of our clients servers were hacked and were being used to ddos. After investigation I figured out that the client which didnt change their server details from whmcs were hacked, which means whmcs was compromised or hacked. Also I saw unusual activity in whmcs as well.
Here are some examples:
http://screensnapr.com/v/mLPr6Q.jpg A Order with -ve balance.
and when browsed to the client profile, there is no product or service on their account.
Scrren Shot :http://screensnapr.com/v/SlzAKt.jpg
One more thing whenever we used the intelligent search option, WHMCS would ask us to re login. So I went ahead and replaced the whmcs files with fresh new ones and then we could not produce any more errors.
What surprises me is, We were using the latest version of whmcs and everything is secured.
We host our website with KnownHost and the VPS was secured as well, didnt get any notification of anyone enter the vps or logging to it. I did speak to KnownHost and they said they do not find anything suspicious in my account.
One Point I would like to mention is the templates_c folder was in the whmcs folder, so could this be the reason ? What is usually stored in templates_c folder ?
I am not sure how the hacker managed to hack it
Any Help or assistance would be great!