Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.
Not a member yet? Click here to register.
Forgot Password?

Hacked again??

Asked Modified Viewed 3,849 times
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
asked
Junior Member

Well, I've been hacked over and over again by 2 separate persons/groups. All of my sites are v6.01.10. One site has been hacked twice in 4 days. Has anyone else had this problem? It's getting so bad that I have to have a database backup with me at all times. I have changed all passwords to random 15 digit alpha/numeric combinations. There must be some exploit being used. I'm thinking infusions? :@:(:o
0 replies

15 posts

M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

Could this be the leak? A "aftermarket" contact page:

<?php
/*---------------------------------------------------+
PHPFusion 6 Content Management System
+----------------------------------------------------+
| Copyright © 2002 - 2006 Nick Jones
| http://www.php-fusion.co.uk/
+----------------------------------------------------+
| Released under the terms & conditions of v2 of the
| GNU General Public License. For details refer to
| the included gpl.txt file or visit http://gnu.org
+----------------------------------------------------*/
require_once "maincore.php";
require_once "subheader.php";
require_once "side_left.php";
include LOCALE.LOCALESET."contact.php";


if (!empty($_POST['other1'])){
$choose3 = stripslashes($_POST['other1']);
}else{
$choose3 = stripslashes($_POST['choose3']);
}
$choose = substr(stripinput(trim($_POST['choose'])),0,15);
$choose2 = substr(stripinput(trim($_POST['choose2'])),0,15);


if (isset($_POST['sendmessage'])) {
$error = "";
$mailname = substr(stripinput(trim($_POST['mailname'])),0,50);
$email = substr(stripinput(trim($_POST['email'])),0,100);

//-------------------------------------------------
// Subject line of message to be sent
//--------------------------------------------------

$subject = "".$mailname."'s Catalog Request";

//-------------------------------------------------------
//Create list of items to inlcude in message body of email
//------------------------------------------------------

$message = "Name: ".$mailname."; \nAddress: \n".descript(stripslash(trim($_POST['address'])))."; \nTel no: ".$telno."; \nFax no: ".$faxno."; \nemail: ".$email."; \nExtra details:\n".descript(stripslash(trim($_POST['jobdesc']))).".";
if ($other == ""){
$choose3 = substr(stripinput(trim($_POST['choose3'])),0,20);
}else{
$choose3 = substr(stripinput(trim($_POST['other1'])),0,50);
}

if ($mailname == "") {
$error .= "· <span class='alt'>".$locale['420']."</span><br>\n";
}
if ($email == "" || !preg_match("/^[-0-9A-Z_\.]{1,50}@([-0-9A-Z_\.]+\.){1,50}([0-9A-Z]){2,4}$/i", $email)) {
$error .= "· <span class='alt'>".$locale['421']."</span><br>\n";
}
if ($message == "") {
$error .= "· <span class='alt'>".$locale['423']."</span><br>\n";
}


echo $subject;
if (!$error) {
require_once INCLUDES."sendmail_include.php";

//------------------------------------------------
// Need to insert email address to send to next line
//--------------------------------------------------

sendemail($settings['siteusername'],"****@***.com",$mailname,$email,$subject,$message);
opentable($locale['B400']);
echo "<center><br>\n".$locale['440']."<br><br>\n".$locale['441']."</center><br>\n";
closetable();
} else {
opentable($locale['B400']);
echo "<center><br>\n".$locale['442']."<br><br>\n$error<br>\n".$locale['443']."</center><br>\n";
closetable();
}
} else {
opentable($locale['B400']);
echo $locale['B401']."<br><br>
<form name='userform' method='post' action='".FUSION_SELF."'>
<table align='center' cellpadding='3' cellspacing='0' class='tbl'>


<tr>
<td colspan=2 width=90% align=center>

   
<table width='100%' cellpadding='10' border='0'><tbody>   
<tr>   <tr>
<td colspan=3 align=left><font size=4 color=blue><center>Alack Refrigeration Catalog Request Form</center></font>
</tr></td>
   </tr>
   </tbody></table>
   <br />
                   

     <div align='left'>
       You may get catalog information by phone, fax, email or by filling out the following form.   If however you require an urgent response please telephone us.
<p> Phone: <b>985-345-9476</b><br />
Toll Free: <b>800-847-3201</b><br />
 Fax: <b>985-542-6560</b><br />
 E-mail: <a href='mailto:alackinfo@alack.com'>alackinfo@alack.com</a> </p>

<p> ( * ) These fields are required information.</p>
</div></div>


<tr>
<td width='400'>Full Name: *</td>
<td><input type='text' name='mailname' maxlength='50' class='textbox' style='width: 250px;'></td>
</tr>

<tr>
<td width='400'>Mailing Address: *</td>
<td><textarea name='address' rows='4' class='textbox' style='width: 250px;'></textarea></td>
</tr>

<tr>
<td width='400'>Telephone number:</td>
<td><input type='text' name='telno' maxlength='50' class='textbox' style='width: 250px;'></td>
</tr>

<tr>
<td width='400'>Fax number:</td>
<td><input type='text' name='faxno' maxlength='50' class='textbox' style='width: 250px;'></td>
</tr>

<tr>
<td width='400'>E-Mail: *</td>
<td><input type='text' name='email' maxlength='100' class='textbox' style='width: 250px;'></td>
</tr>


<tr>
<td width='400'>Name of your Business: *</td>
<td><input type='text' name='business_name' maxlength='50' class='textbox' style='width: 400px;'></td>
</tr>

<tr>
<td width='400'>Type of business: *</td>
<td>
<SELECT NAME='Type_of_business'>
<OPTION SELECTED VALUE='Select'>Select
<OPTION VALUE='Resraurant'>Restaurant
<OPTION VALUE='Bar'>Bar
<OPTION VALUE='Caterer'>Caterer
<OPTION VALUE='Supplier'>Supplier
<OPTION VALUE='Other'>Other
</SELECT></td>
</tr>





<tr>
<td valign='top' width='400'>Additional Comments: (50 words max!)</td>
<td><textarea name='jobdesc' rows='6' cols='50' class='textbox'></textarea></td>
</tr>


<tr>
<td align='center' colspan='2'>
<input type='submit' name='sendmessage' value='Submit' class='button'> or <input type='reset' value='Clear the form' class='button'>
</td>
</tr>
</table>
</form>\n";
closetable();
}

require_once "side_right.php";
require_once "footer.php";
?>
Edited by MutantCheese on 25-06-2007 06:14,
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

I removed this form. The more I think about it, the more I'm convinced that it's the security leak.
0 replies
W
wibix
W
wibix 10
  • Member, joined since
  • Contributed 73 posts on the community forums.
  • Started 15 threads in the forums
answered
Member

what happened? db deleted? files replaced? the script above could be abused to send spam if it was vulnerable but there is not way to hack the site.
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

Admin account hijacked and various news articles deleted. Altered front page with hacker message...you know, pretty harmless in the grand scheme, but flippin' annoying and embarrassing for me when my client sees it.
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

The only other non-standard item on the site is a googlemap infusion that I created. Does anyone see a potential threat here:

<?php


/*--------------------------------------------+
| PHPFusion 6 - Content Management System    |
|---------------------------------------------|
| author: Nick Jones (Digitanium) © 2002-2005 |
| web: http://www.php-fusion.co.uk            |
| email: nick@php-fusion.co.uk                |
|---------------------------------------------|
| Infusion by: MutantCheese         |
|                            |
|---------------------------------------------|
| Released under the terms and conditions of  |
| the GNU General Public License (Version 2)  |
+--------------------------------------------*/
require_once "../../maincore.php";
require_once BASEDIR."subheader.php";
require_once BASEDIR."side_left.php";




$subject = $HTTP_POST_VARS['subject'];
if (file_exists(INFUSIONS."googlemap/locale/".$settings['locale'].".php")) {
   include INFUSIONS."googlemap/locale/".$settings['locale'].".php";
} else {
   include INFUSIONS."googlemap/locale/English.php";
}


echo'
  <head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
    <title>Google Map</title>

<center>Alack Refrigeration Map<br><a href="http://maps.google.com/maps?f=d&hl=en&saddr=&daddr=1010+W+Coleman+Ave,+Hammond,+LA+70403&sll=37.0625,-95.677068&sspn=30.599615,85.78125&ie=UTF8&ll=30.499753,-90.470309&spn=0.008116,0.020943&z=16&iwloc=addr&om=1"target="_blank">Click here for driving directions.</a><br><br></center>
    <script src="http://maps.google.com/maps?file=api&v=2&key=ABQIAAAAJxRuO_T5gCT3XAtUlWoqoRSLxKVpPqsxbiOizpNRGWiIH7q2lBSh1kg--12G2rRwkNbw1kXdMk0O6w"
      type="text/javascript"></script>
    <script type="text/javascript">

    //<![CDATA[

    function load() {
      if (GBrowserIsCompatible()) {
        var map = new GMap2(document.getElementById("map"));
map.addControl(new GSmallMapControl());
map.addControl(new GMapTypeControl());
        map.setCenter(new GLatLng(30.498736,-90.470482), 16);
map.openInfoWindowHtml(map.getCenter(),"<b>Alack Refrigeration, Inc.</b><br>1010 Coleman Ave.<br>Hammond, LA 70403<br>Phone:(985) 345-9476<br>Toll-free: 800-857-3201<br>Fax:(985) 542-6560");
      }
    }


    //]]>


    </script>
  </head>
  <body onload="load()" onunload="GUnload()">
   <center> <div id="map" style="width: 800px; height: 500px"></div></center>
  </body>
';
closetable();

// Right block control start
if ($side_right==1) {
require_once BASEDIR."side_right.php";
} else {
   echo "</td>\n";
}
// Right block control end

require_once BASEDIR."footer.php";

?>
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

After reviewing my files, the only thing that I can see is that they left behind 3 jpg images. Their logo, and 2 bull terrier pictures??? :o There is no way of hiding code in image files is there?
0 replies
K
Ken
K
Ken 10
No Support by PM. Please use the forum.
  • Senior Member, joined since
  • Contributed 713 posts on the community forums.
  • Started 43 threads in the forums
answered
Senior Member

What site are we talking about? If it is the gnoCIVIC.com I would remove the Calendar Infusion. What other Infusions are you running? Are they all safe to use?
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

It's neither of the sites listed in my sig. The main site in question is alack.com.

So far, I haven't had any issues with those listed in my sig. :|
Edited by MutantCheese on 25-06-2007 17:30,
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

No, they just hijacked my admin account. I did have about 15 customers who registered on the site before the hackings began. They deleted those accounts for me. I think so that they would be sure they were not admins accounts so it would be harder for me to get back in.
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

You mean through the database? If they get in again, I may try that.
0 replies
J
jiikoo
J
jiikoo 10
Lorem ipsum dolor sit amet
  • Junior Member, joined since
  • Contributed 10 posts on the community forums.
  • Started 5 threads in the forums
answered
Junior Member

Quote

MutantCheese wrote:
I'm thinking infusions? :@:(:o


Tell us what infusions you have installed to the site. If you dare to tell us the URL of your site, you will get more info after I have tried to hack in :D
0 replies
M
Mys3lf
M
Mys3lf 10
Dancing Banana Photo
PHPFusion-lt.com
  • Newbie, joined since
  • Contributed 4 posts on the community forums.
answered
Newbie

Quote

jiikoo wrote:
Tell us what infusions you have installed to the site. If you dare to tell us the URL of your site, you will get more info after I have tried to hack in :D


Pro-Hax0r. Can't even read. :D
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

Yeah, I gave the url earlier. No additional infusions other than stock fusion offers. No new infiltrations as yet.
0 replies
M
MutantCheese
M
  • Junior Member, joined since
  • Contributed 42 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
answered
Junior Member

i have not been hacked since I removed the aftermarket contact page detailed in my second post. Does anyone see a way to gain entry through this code?
0 replies
W
wibix
W
wibix 10
  • Member, joined since
  • Contributed 73 posts on the community forums.
  • Started 15 threads in the forums
answered
Member

no, there is absolutely no way - just try it ;)
0 replies

Category Forum

Bugs and Errors - 6

Labels

None yet

Statistics

  • Views 0 views
  • Posts 15 posts
  • Votes 0 votes
  • Topic users 5 members

0 participants

Notifications

Track thread

You are not receiving notifications from this thread.

Related Questions

Not yet