Home Private Messages Search
CPG Dragonfly™ CMS stopsoftwarepatents.eu petition banner
Toggle Content
 
Forums ⇒ DragonflyCMS ⇒ Add-Ons & Blocks :: Archives ⇒ Hack on my Site :: Archived


Hack on my Site :: Archived
Need help creating a block or add-on, or you have created or modified a block/add-on that works in Dragonfly CMS and it meets the CPG Security Requirements? Do you have feedback about a specific add-on? Here is the place to post. Read the announcements here first!.
Go to page 1, 2  Next
Post new topic    Revive this topic    Printer Friendly Page     Forum Index ⇒  Add-Ons & Blocks

Topic Archived View previous topic :: View next topic  
Author Message
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Tue Jan 31, 2006 7:05 pm
Post subject: Hack on my Site

it was a redirect on my site from webalbania.com to vlora.it

The system has register this..

On /index.php
While executing query "INSERT INTO cms_msanalysis_online ( time, uname, agent, ip_addr, host, domain, modulename, scr_res, referral, ref_query ) values ( '2006-01-31 18:07:02', 'Guest', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Sgrunt|V109|17|S191239928|dial; EnergyPlugIn; dial; XBE|29|S04037620801143; (R1 1.5); snprtz|S04045866603162)', '192.168.203.11', '192.168.203.11', '11', '', '1024x768x24', 'www.webalbania.com', 'name=Your_Account&profile=roni">alert('foo')' )"

the following error occured: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'foo')' )' at line 1

In: /home/httpd/vhosts/webalbania.com/httpdocs/modules/DF_MSAnalysis/mstrack.php on line: 101

Guest information:
User id: 1
Username: Anonymous
Admin: No
IP: 80.105.110.114
Host: host114-110.pool80105.interbusiness.it


This was the first register and the second
On /index.php
While executing query "INSERT INTO cms_msanalysis_online ( time, uname, agent, ip_addr, host, domain, modulename, scr_res, referral, ref_query ) values ( '2006-01-31 18:18:20', 'Guest', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Sgrunt|V109|17|S191239928|dial; EnergyPlugIn; dial; XBE|29|S04037620801143; (R1 1.5); snprtz|S04045866603162)', '192.168.203.11', '192.168.203.11', '11', '', '1024x768x24', 'www.webalbania.com', 'name=Your_Account&profile=anyone">alert('vlora.it_siti_me_i_me_mire')' )"

the following error occured: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'vlora.it_siti_me_i_me_mire')' )' at line 1



On /index.php
While executing query "INSERT INTO cms_msanalysis_online ( time, uname, agent, ip_addr, host, domain, modulename, scr_res, referral, ref_query ) values ( '2006-01-31 18:20:51', 'Guest', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Sgrunt|V109|17|S191239928|dial; EnergyPlugIn; dial; XBE|29|S04037620801143; (R1 1.5); snprtz|S04045866603162)', '192.168.203.11', '192.168.203.11', '11', '', '1024x768x24', 'www.webalbania.com', 'name=Your_Account&profile=anyone">location='http://www.vlora.it/';' )"

the following error occured: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'http://www.vlora.it/';' )' at line 1


so when i try to open my web site the adress make on vlora.it

now is ok,but for the next they can do anymore time???

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
musox
Platinum Supporter
Platinum Supporter

Offline Offline
Joined: Apr 20, 2004
Posts: 325

PostPosted: Tue Jan 31, 2006 7:56 pm
Post subject: Re: Hack on my Site

I'm having a hard time understanding how this is a hack. I am concerned as I maintain DF MSAnalysis and if there is an exploit, I want to know and fix it ASAP.

The error is comming from the double quote after &profile=anyone. That is ending the INSERT query.

- MusOX

_________________
../musox.com
Hosted by: Site5.com

musox's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Linux / 1.3.39 / 4.1.22 / 4.4.7 / 9.2.1
Back to top
View user's profile Visit poster's website Photo Gallery
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Tue Jan 31, 2006 8:40 pm
Post subject: Re: Hack on my Site

There are 2 exploits here:

SQL: the data inserted into the query is not escape_string()end

XSS: someone links to index.php?name=Your_Account&profile=roni">alert('foo') and tries if that opens up a security exploit.

example: dragonflycms.org/index...ofile=roni">test but as you see it fails here.


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
musox
Platinum Supporter
Platinum Supporter

Offline Offline
Joined: Apr 20, 2004
Posts: 325

PostPosted: Tue Jan 31, 2006 8:42 pm
Post subject: Re: Hack on my Site

As long as the issue is not with DFMSA, then I'm happy that we use Dragonfly. Very Happy

- MusOX

_________________
../musox.com
Hosted by: Site5.com

musox's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Linux / 1.3.39 / 4.1.22 / 4.4.7 / 9.2.1
Back to top
View user's profile Visit poster's website Photo Gallery
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Wed Feb 01, 2006 9:05 am
Post subject: Re: Hack on my Site

today they have do the something....

Help me

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Wed Feb 01, 2006 9:17 am
Post subject: Re: Hack on my Site

albanialove wrote:
today they have do the something....

Get rid of MSA


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Wed Feb 01, 2006 9:44 am
Post subject: Re: Hack on my Site

i have Get rid msa but the same...

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Wed Feb 01, 2006 12:13 pm
Post subject: Re: Hack on my Site

1. i'm a visitor and don't see your XSS vulnerable block
2. server specs ?
3. browser ?
4. which non-certified add-ons are installed ?


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Wed Feb 01, 2006 11:07 pm
Post subject: Re: Hack on my Site

I'm on linux server.
Database: MySql
browser: for the moment int.Explorer

The same problem have all users....Is a really redirect on this site.

Today i have speak with director of host where i am and he have see the something..redirect.

The redirect is maket on all the files includes on MySql database so all on DragonFly

The "Hacker" has do a redirect for all the day...

every 30 min he do redirect for 3-5 min.

Probably broadcast?

So we want to know if is a server problem or Dragonfly?

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Wed Feb 01, 2006 11:20 pm
Post subject: Re: Hack on my Site

Dragonfly version ?
User info block version ?
Other block that shows "Who is where" ?

Cos i've tested and the exploit he uses does not work on stock items.


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Wed Feb 01, 2006 11:36 pm
Post subject: Re: Hack on my Site

are all the newest versions Dragonfly 9.0.6.1

on January 24, 2006 i have update the site because i have change server so this where i am

dragonflycms.org/Forum...14628.html

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Thu Feb 02, 2006 8:54 am
Post subject: Re: Hack on my Site

if u try in a few moments you can see the redirect...

www.webalbania.com

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Thu Feb 02, 2006 9:09 am
Post subject: Re: Hack on my Site

loock this on my html page:

This are the users online:

2: <a href="index.php?name=Your_Account&amp;profile=KLEOPATRA">KLEOPATRA</a> &gt; <a href="/">Faqa kryesore</a><br />
3: <a href="index.php?name=Your_Account&amp;profile=milano">milano</a> &gt; <a href="/">Faqa kryesore</a><br />
<img src="images/blocks/visitors.gif" alt="" />&nbsp;<span class="content"><b>Vizitor(ë):</b></span><br />1: <a href="/index.php"> Faqa kryesore</a><br />
2: <a href="/index.php?name=Your_Account&amp;profile=anyone"><script>location='http://www.vlora.it/';</script>"> Your Account</a><br />3: <a href="/index.php?name=coppermine&amp;file=displayimage&amp;meta=lastcom&amp;cat=0&amp;pos=7"> Albumet Fotografike</a><br />
</td>

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
DJ Maze
Developer
Developer

Offline Offline
Joined: Apr 19, 2004
Posts: 5683
Location: http://tinyurl.com/5z8dmv
PostPosted: Thu Feb 02, 2006 11:16 am
Post subject: Re: Hack on my Site

Ok i've figured it out.

My firefox encodes the url "> becomes %22%3E but IE and others don't encode it.
Due to this i thought we already covered the issue but it seems we didn't.

Get this fix dragonflycms.org/cvs/h...?v=9.24#85


DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
Back to top
View user's profile Visit poster's website Yahoo Messenger Photo Gallery
albanialove
Nice poster
Nice poster

Offline Offline
Joined: Dec 13, 2004
Posts: 83

PostPosted: Thu Feb 02, 2006 11:43 am
Post subject: Re: Hack on my Site

I have coppy only this:
PHP:
<?php
function get_uri()
{
if (
ereg('IIS', $_SERVER['SERVER_SOFTWARE']) && isset($_SERVER['SCRIPT_NAME'])) {
$REQUEST_URI = $_SERVER['SCRIPT_NAME'];
if (isset(
$_SERVER['QUERY_STRING'])) {
$REQUEST_URI .= '?'.$_SERVER['QUERY_STRING'];
}
} else {
$REQUEST_URI = $_SERVER['REQUEST_URI'];
}
# firefox encodes url by default but others don't
$REQUEST_URI = urldecode($REQUEST_URI);
# encode the url " %22 and <> %3C%3E
$REQUEST_URI = str_replace('"', '%22', $REQUEST_URI);
$REQUEST_URI = preg_replace('#([\x3C\x3E])#e', '"%".bin2hex(\'\\1\')', $REQUEST_URI);
$REQUEST_URI = substr($REQUEST_URI, 0, strlen($REQUEST_URI)-strlen(stristr($REQUEST_URI, '&CMSSESSID')));
return
$REQUEST_URI;
}

Thax DjMaze you are the best on here.

Roni

_________________
webalbania.com

albanialove's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Php 5.0.4 /MySQL 5.0.26/DF CMS 9.1.1.RC2
Back to top
View user's profile Visit poster's website
Display posts from previous:   
Post new topic    Revive this topic    Printer Friendly Page    Forum Index ⇒  Add-Ons & Blocks
Page 1 of 2
All times are GMT
Go to page 1, 2  Next

Archive Revive
Username:
This is an archived topic - your reply will not be appended here.
Instead, a new topic will be generated in the active forum.
The new topic will provide a reference link to this archived topic.
 
   Toggle Content User Info

Welcome Anonymous

Nickname
Password
(Register)

   Toggle Content Last CVS commits
· Fixed .ico Expires header.
· Removed domain name from cookies so subdomains wont access them anymore.
· CSS and JS, case insensitives.
· CSS and JS, send correct HTTP 1.1 headers and fixed issues where themes and...
· Further security class improvements.
· 301 redirects on LEO changes
· Option to force 3xx http status codes
· Validate googlebot.com and google.com crawlers.
· CCBot
· Rss with etag and atom.

もっと読む

   Toggle Content Community

Support for DragonflyCMS in a other languages:

Deutsch
Español

   Toggle Content X-links
UltraEdit Browse Happy logo Firefox MySQL PostgreSQL Valid CSS! Valid XHTML 1.0! Unicode Encoded Badge NukeBiz Resources Raven DragonflyCMS Dedicated Now InsideSupport Lampe Berger

You are seeing squares or questionmarks on this page?

All content of this website is copyrighted by the Creative Commons NC-SA
The logos and trademarks used on this site are the property of their respective owners
We are not responsible for comments posted by our users, as they are the property of the poster.
Our server runs on a P3 1.2GHz with 512MB RAM with no accelerators
Support GoPHP5.org
Interactive software released under GNU GPL, Code Credits, Privacy Policy