My site was hacked into, admin added, any idea how?

I gather some people out there prey on sites they think no one is monitoring, based on what this person did. While yes, I do have many sites, I do check on them regularly.

Today I checked on my website, retrotutorials.com, this site runs off of tutorialSHRE and is hosted by Alwayswebhosting, anyway, if you see the news at the top, I add that myself when I update. Today I see a news entry I did not make:

I decided to look into this further, in my database, in the users table, there's now 2 admins. Me of course and this individual. Here's the content from his entry in my database:

id: 2
name: Contact Me
password: ad48ca5948fd0ba8789dfe9069b8865f
usergroup: admin
email: [email]emeston@gmail.com[/email]

Code (markup):

Yes, will you please all contact him and tell him off!

Anyway, I am not removing anything as of yet, because I want my host to look into it. I viewed my Raw Access Logs but they only cover today.

Would this be an issue with my script or my host? Aside from changing my password, is there anything I can do to be safe?

 

He sounds like a white-hat hacker who is just trying for free publicity. I would guess it's a vulnerability within one of your scripts on your site, and he noticed it and exploited it via a simple line of code or program.

No need to "tell him off", just update software, and delete the admin account that has been added by him. If you have his IP (even though he probably used a proxy-chain), you could trace it.

Need any more help, I do this for a living, so you can contact me via PM.

Good luck.

 

I think he found the Exploit in the script u are using on your site & just found way to free promotion...

 

Uhmm shouldn't you be trying to figure out how he hacked you and how not to get hacked again rather than gathering an cyber army to e-spank that guy? Its probably some weakness in one of your scripts and if it was not him it could have been anyone else.

 

This seems there is a shell somewhere on the server connected to your database. Which he uses to import his own admin account. I have dealt with this crap in the paste