The "Check Your Diary" section title is corrupted

Post by **Robert T** » Mon 08 Jun, 2009 17:25

Looks like we have been the victim of a SQL injection attack. The heading for the "Check Your Diary" sections seems to have been overwritten by something in Russian. I would expect more of the same as it looks like someone is trying to find a way in. Patch me quick.

Cheers R.

Titan · Post by **Titan** » Mon 08 Jun, 2009 17:33

Possibly the same Cossack who calls themselves HACKER in the lower Announcements Box ...

Incidentally - why do we need two "announcements" especially as the bottom one is out of date

Post by **Robert T** » Mon 08 Jun, 2009 17:39

Titan wrote:Possibly the same Cossack who calls themselves HACKER in the lower Announcements Box ...

Oh ****. That just went in the last few mins. That would be Tim's account - don't know if it has been compromised or if he has just had his username mangled - not good if it has been compromised. MEDIC!

R.

Phil · Post by **Phil** » Mon 08 Jun, 2009 18:09

Mmm - strange as I updated the homepage this morning.
Any thoughts anyone?

Post by **Robert T** » Mon 08 Jun, 2009 18:35

Phil, whatever is going on is happening in the database behind the forum.

The title of the Check Your Diary section has been altered so that it reads as something about banditry in Russian - it is changed everywhere where it would be pulled out of that table - ie on the Forums listing and on the jump to box.

More importantly Tim Cullis' username is now HACKER. If you search for all posts by HACKER, you will get all Tim's posts, so again this is in the database. At Tim is site admin, if his account has been comprised it could be difficult to clean up. Changing his password is one option, but beware, as this could also email the hacker the password.

I would suggest checking that we are patched up to date and keep a close eye on things. Taking a backup would be a good idea too.

Cheers R.

Guest · Post by **Guest** » Mon 08 Jun, 2009 18:49

Is it my imagination or did it say something different under our Profile names ?

It says LOH now for most people ??

Is this connected?

PVR · Post by **PVR** » Mon 08 Jun, 2009 19:01

You see, if you were a Z register member you would have been unaffected

burmagirl · Post by **burmagirl** » Mon 08 Jun, 2009 19:02

Mmmm, just starting to post about this when I found the thread!!

Sue

spokey · Post by **spokey** » Mon 08 Jun, 2009 19:42

Crap. Can people please let me know if something like this happens again? Thanks!

Please note that if it does, I may have to disable the board until we can find a workaround.

Sorry.

Post by **Robert T** » Mon 08 Jun, 2009 19:59

Thank you, Spokey. Emergency procedure duly noted.

Pants - just noticed I am still an LOH...

Cheers R.

Phil · Post by **Phil** » Mon 08 Jun, 2009 20:05

The Grand Wizier - Tim Cullis - is working on it