I’m starting to notice this on several of my sites. Someone is injecting "?phpMyAdmin=" followed by a bunch of characters in chunks, snippets, and content where there’s a link or a form submission. Is this being done by SQL injection or have they somehow figured out the DB password? How can someone inject code in "specific" areas of specific records in certain tables?
-
☆ A M B ☆
- 2,475 Posts
Watch your cornhole, my friend, because THAT’s what it looks like when someone’s trying to hack you. Yes, someone is trying to inject crap into your forms to hack your database. They hacker is attempting to gain access via SQL injection... if your forms aren’t properly filtering your input, then one of those bogus form submissions may be able to execute additional commands against your database, then you’re in trouble. The worst part is that you may not even know if the attack was successful or not... your passwords, and sensitive data... all may have been compromised.
Do you have backups? What forms do you have open on your site? And how is the data being filtered?
Yes, running Plesk, but no forms at all. Not sure what you mean by a backup extension? I’ll check Apache logs.
Seems as if an automated script is running several attacks here.
Since none of your scripts is actually taking the GET-variable "phpmyadmin" as input, this attack will lead the attacker into nowhere.
Apache-Logs could help you further. Check out, what script accessed your site with that "phpmyadmin-parameter". There are some frameworks "on the air" that check for some well-known security issues, such as even phpmyadmin might have.
Some hints in the attackers "footprint" can lead you to the script that´s been used to "attack" your site. Maybe, with a bit of "forensic actions", you could determine what kind of script has been used and how that one could harm your site.
What you could do to prevent from being attacked...
As above mentioned, have a look at your logs. If there are many entries from one IP with some strange looking parameters and 404(or 403)-errors, then you might have found such an "attacker".
Because of the way the Internet works, there´s (in general) no limit of how many access-attempts one could run against your server. Every attempt to connect is being answered from your Apache (or whatever server you use). If someone accesses your server 100 times per second, your server may not be able to respond to further access-attempts (Denial-Of-Service).
There are some ways to limit obsessive attempts to connect...
One might be a script that blocks users that "come back too often" in a specified time, say 10 seconds. No real user would ever try to access your site 100 times a second or more, or about 100 times a minute. That might be a bit too strange.
Just some hints and thoughts here...
$cd /pub
$more beer
-
MODX Staff
- 10,725 Posts
I really don’t think this is an attack; I’ve seen this on Plesk hosts many times, and it usually happens after making a backup of the database and importing it, or it could just be occurring when the pages are cached (something to do with rewrite rules)...
I agree with opengeek here, I’m certain we’ve seen this before in the forums though I can’t find anything specific unfortunately. If I remember correctly plesk seems to tag tables with somekind of unique identification string when you back them up through phpmyadmin, you can always check with your hosting provider.
Use MODx, or the cat gets it!
I’m using EVault InfoStage for nightly backups of the Linux file system and have been for a year or so. I’m not using any MySQL type backup. However, this has only recently started happening. I’ll check with the host though and see if they know of anything.
I’m seeing several scanners in the Apache logs: "Toata dragostea mea..." and "Morfeus F-ing Scanner" so I’m not sure if those are related.
Let me know if you recall anything.
This was the thread I had in mind :-
http://modxcms.com/forums/index.php?topic=21033.0, have a read of this, see if it makes sense in your setup
Use MODx, or the cat gets it!
