We got hack because of a bad security on our server. The hacker got access of the database probably from a php file holding database credentials in the html folder. The /var/www/html folder had root privileges and 777 permissions. Could the hacker have had injected anything outside the /var/www/html folder? Do we have to reset our server, or proper security would do?
Note that we already changed permissions and ownership of the html folder and files inside. We also changed the database credentials and implemented some MySQL security. Also blocked all ports except for the http, https and ssh port (change the ssh port as well)