SQL_Injection_hack

Community saint

Hi everyone, I just recently added a new category to our forums in OCF. Within the last few hours, everyone who attempts to enter the category receives the message, "An Error Has Occurred", The website software has detected what may be a hacking attempt. The stack trace indicates it is an SQL injection hack. My server log doesn't even record the error, so it is difficult to add anything. I am still using 5.0.2

Any ideas on what I should do? I would post the full stack trace, but I am even having trouble getting this to post.

Posted 23 June 2011, 11:36 PM

Rating:

#71019

ocStaff (admin)

Hi,

Could you forward the hack-attack notification that would have been sent to your staff address to chris@ocportal.com.

Become a fan of ocPortal on Facebook or add me as a friend.

Was I helpful?

If not, please let us know how we can do better (please make suggestions that are economically viable and scalable, not just requests to do more for free).
If so, please let others know about ocPortal whenever you see the opportunity.

Follow me on Twitter

This information has not loaded yet. It will be generated in the background, please come back later.

If I answered something that you think should be in the documentation, please take the initiative and add it to the community documentation. We really need people to help out here and build a well-organised large support resource.

Posted 23 June 2011, 11:49 PM

Rating:

#71021

Community saint

Hi Chris,

I just forwarded the message to you.

Thanks,
Keith

Posted 24 June 2011, 12:40 AM

Rating:

#71022

Community saint

Hey Chris,

I found the problem. It was an advertisement function from Forbes.com. Once I removed the offending post in the forum, all was right with the world, again.

I have just completed an upgrade to 7.1. I have just a few issues with my old theme, and once that is done, the world will continue to spin on its axis once again, and we can all begin to breath naturally. :lol:

Thank you so very much for all the great work you do with OCP. I recommend OCP every chance I get. The flexibility of your script is phenomenal.

Regards,
psydoc (Keith)

Posted 24 June 2011, 12:53 AM

Rating:

#71023

Fletch

Community saint

psydoc said

… an advertisement function from Forbes.com.
I recommend OCP every chance I get. The flexibility of your script is phenomenal.

WB Keith. Been absent for too long, but there again, if you are mixing with the 'Forbes Rich' it is probably understandable!

:lol:

Take my advice. I'm not using it!

View my working ocPortal site (version 9.x.x) at Anglo-Indian Portal

Posted 24 June 2011, 1:30 AM

Rating:

#71025

Community saint

Hey Fletch,

Unfortunately, I don't mix with the 'Forbes Rich', I just post articles from there, once in a while.

Thanks for the welcome. I hope everything is going well with you, and everyone at OCP. :thumbs:

Posted 24 June 2011, 1:32 AM

Rating:

#71026

Community saint

btw Terry, may I use your ITOD, "Miss Airport 2011"?

Posted 24 June 2011, 1:51 AM

Rating:

#71030

Fletch

Community saint

Help yourself Keith. I can send you all 13 zipped if you want to stagger them.

The 13th is …

Take my advice. I'm not using it!

View my working ocPortal site (version 9.x.x) at Anglo-Indian Portal

Posted 24 June 2011, 1:53 AM

Rating:

#71032

Community saint

I would love to post those. Do you still have my email?

Posted 24 June 2011, 1:56 AM

Rating:

#71033

Fletch

Community saint

On its way …

Take my advice. I'm not using it!

View my working ocPortal site (version 9.x.x) at Anglo-Indian Portal

Posted 24 June 2011, 1:58 AM

Rating:

#71034

Community saint

Thanks, Terry!

I love your site. You have done a lot with it since I looked at it last.

Posted 24 June 2011, 12:14 PM

Rating:

#71058

ocStaff (admin)

lol

Become a fan of ocPortal on Facebook or add me as a friend.

Was I helpful?

If not, please let us know how we can do better (please make suggestions that are economically viable and scalable, not just requests to do more for free).
If so, please let others know about ocPortal whenever you see the opportunity.

Follow me on Twitter

This information has not loaded yet. It will be generated in the background, please come back later.

Posted 24 June 2011, 12:20 PM

Rating:

#71059

ocStaff (admin)

Right. The SQL injection checker did not like:

Didn't Save Union Jobs

because the apostrophe in the query looks like a string section is being ended then 'union' is SQL to join queries together (hackers often use it to inject malicious queries). I'll see if we can make the scanner smarter here.

Become a fan of ocPortal on Facebook or add me as a friend.

Was I helpful?

If not, please let us know how we can do better (please make suggestions that are economically viable and scalable, not just requests to do more for free).
If so, please let others know about ocPortal whenever you see the opportunity.

Follow me on Twitter

This information has not loaded yet. It will be generated in the background, please come back later.

Posted 24 June 2011, 12:25 PM

Rating:

#71060

ocStaff (admin)

Hmm, we already fixed it.

Look for the SQL_INJECTION_HACK line in sources/database.php and change to:

Code



         if ((strpos(preg_replace('#\'[^\']*\'#','\'\'',str_replace('\\\'','',$_query)),' union ')!==false) || ($queries>1)) log_hack_attack_and_exit('SQL_INJECTION_HACK',$query);

Become a fan of ocPortal on Facebook or add me as a friend.

Was I helpful?

If not, please let us know how we can do better (please make suggestions that are economically viable and scalable, not just requests to do more for free).
If so, please let others know about ocPortal whenever you see the opportunity.

Follow me on Twitter

This information has not loaded yet. It will be generated in the background, please come back later.

Posted 24 June 2011, 4:25 PM

Rating:

#71077

Community saint

Thanks, Chris. You did fix it. I upgraded to 7.1, and you had already change it from the query first to str_replace then query.

I think I understand that. Is my understanding correct?

At any rate, Chris, you and the OCP staff never cease to amaze. :thumbs:

Posted 24 June 2011, 4:41 PM

Rating:

#71078