1

It looks like one of my sites has been compromised with an SQL injection. All the channel entries have been closed, which amounts to over 5k entries.

I restored the database with a previous daily backed, so all is well again, but have no idea what could have caused this, seems most likely to be a rogue sql query as no way to accidentally change all open statuses to closed in the CP.

I have added in extra security by changing passwords, system directory name, removed some add-ons, switched XSS filter back, check permissions, etc.

The site's still on 1.7 and Ellislab have had a look around the CP and say they can't see any evidence of a virus.

I'd be very interested to hear if anyone has had a similar experience.

Improve this question
6
  • 1
    Do you have the Structure module installed?
    – Peter Lewis
    Jan 17, 2014 at 12:47
  • Any custom add-ons? Any cron jobs which call an EE action?
    – Derek Hogue
    Jan 17, 2014 at 14:00
  • Not using Structure, the add-ons being used are Cartthrob, User, Wygwam, Freeform, Better Meta, Form Helper, Stand-alone member edit, LinkLocker.
    – Samsull
    Jan 17, 2014 at 14:42
  • Anything in the log files?
    – Tom Jaeger
    Jan 17, 2014 at 15:31
  • I'm pretty sure I remember this happening to a friend of mine and it was a Cartthrob issue rather than a compromise. Let me try to nudge him in the direction of this thread.
    – Jamie Pittock
    Jan 17, 2014 at 15:45

2 Answers 2

Reset to default
1

He's not a SE user so I'll answer this for him here. Apparently he had the same issue and it was down to a bug with maestro payments. Does that sound like it might be it?

CT gave him a patch to fix it so you should contact them.

Improve this answer
1
  • I'll see if I get support off Cartthrob on this, and will post back if get any news.
    – Samsull
    Jan 17, 2014 at 16:49
1

Questions: What payment gateway are you using?

NOTE: If it is related to CT, and CT did indeed close ALL entries, it would most likely be some situation where we have a channel entries call to close a specific entry, but without a limit set on it… and a channel entry id was not passed in the call to close the entry.

Over time, I have seen cases where my add-on or other similar add ons would close a junk load of entries if a limit was not set on the close call and the ID passed in was null or blank.

If indeed it was a CT problem, that's where I'd start looking… Most likely culprit would be a bad callback with missing data and a gateway file with a call to close an entry with no limit set, or something in the core itself calling to close an entry based on some condition hit without an entry id.

In CT2 I know I've gone on hunting expeditions for this kind of thing to make sure it wouldn't happen, but I have not gone through the same process for 1.7

Improve this answer
3
  • Answer: RBS Worldpay Redirect Payment Gateway - where do I look to limit the callback to one entry?
    – Samsull
    Jan 17, 2014 at 17:53
  • I know an upgrade to CT2 is always recommended, and I'd be doing it right now if I had the time, so if a hot fix or even a 'might help' fix comes to mind, please let me know - thanks.
    – Samsull
    Jan 18, 2014 at 9:24
  • 1
    Because the solution may be fairly complex to test and evaluate I suggest you schedule a Phone/Skype appointment with the CartThrob/Mightybigrobot support team at support.mightybigrobot.com. A member of our support team can speak with your personally and will custom tailor a suitable solution to this issue.
    – Chris Newton
    Feb 4, 2014 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.