Here's a weird one

[jenpen]

My client was very pleased with himself yesterday - he had been locked out of Admin and managed to reset the password by "doing an sql query on the database and re-setting it". So far so good, and I admit I was impressed. But... somehow, he has converted the Submit button on his Contact page to a password request.
http://mklcraft.com/MKLgallery/index...age=contact_us

I am trying to find the file to replace. I have tried over-writing tpl_contact_us_default.php but nothing changes. Looking up bits of the errant code in Developer's Toolkit - no results. So it must be a database thing. Where to start? Much obliged...

[kobra]

Start by looking at the file modified dates through FTP

[jenpen]

Yikes! We've had a hacker...

[haredo]

Time to upgrade to 139h and follow this Tutorial..

http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

[jenpen]

Yep, onto it. Thanks!

[haredo]

Your welcome and good luck and take your time...
Remember the override file structure on your upgrade..

[kobra]

We've had a hacker...

Please save youself some time and perform ALL the steps and I really do mean ALL steps

[jenpen]

Thanks haredo and kobra,
Another client got hacked once before, I've done it all once already. Here we go again. What's the chance of that, I'm only running about 8 zen carts and two break-ins.
What's nice this time around is that it's always been a 'showcase' so nothing sensitive there. The hacker must have been disappointed.