CPanel can be exploited by someone reading your e-mail or intercepting an e-mail on your phone when the account is setup (if you've not changed the passwords provided).
Additionally if the password is weak and the attacker knows the naming convention for user accounts (and potentially host created passwords) they may be able to get into your C-Panel.
At this point, if someone gets the passwords to an SSH account (or if for some reason you're host is using the same Username/Password combination for SSH as they are for the Cpanel) they can get into the box with an application like MySQL Workbench through an SSH tunnel. (It's one of the security options in MySQL).
- User gets your SSH account login.
config.php for your website.
- They add the
password from that file to their MySQL Workbench profile.
- They gain access
username has rights for on
If someone gets your SSH password your MySQL server is likely not to be their next attack vector, but it is possible.
It's also possible for them at this point to install their own scripts which connect to a remote MySQL server for exploits (if the server is blocking remote URL opening).
This does happen, but it's a right place at the right time scenario.
It sounds difficult, but I had a corporate client register a hosting account, they forwarded the logins to their IT guy (and a couple of higher up managers) and to myself through e-mail once they came over the server firewall initially from the host. All of the corporate guys get copies of their e-mails on their smart phones (some of them use public networks for checking their e-mails like coffee shops and airports). One of the information streams was compromised and within an hour (I was at lunch when the e-mail came through), someone else had already configured the box and exploited it by the time I tried the logins. It was a new VPS install, so it didn't take too long to fix it. When the host sent the new logins for another different VPS I had them only send them to me. I changed the accesses, encrypted, burned to disc, and mailed the logins to my corporate counterparts (for logging purposes) after I altered all of the host-provided logins and credentials (I also killed c-panel on the machine).
We thought about trying to track down the leak, but it was much easier to implement new corporate policies about logging into foreign networks, password strengths, and chain of custody for logins. A lesson for all.