MODx hacking attemps and vulnerability warnings

Hi, all

My website was hacked yesterday and I spent some time wondering what had been done and how to fix the vulnerability. I fist thought it was due to the old version of Magpie RSS I once used, but thanks to the forum, I now know that I need to upgrade to version 0.9.2.2 and upgrade my Wayfinder menu BEFORE patching. I will do it this evening.

Today, I looked at the keywords used to find my website in Google and found out 6 occurences of "Powered by Modx".
2 from Morocco
2 from Turkey
1 from Czech Republic
1 from Algeria

The turkish guy that came twice did the hack.

I will rework my link towards Modx using a different text and think it can be quite dangerous to have the default text along with the version used on a given website, if other vulnerabilities are advertised by websites like Secunia!

I have subscribed to the Modx blog RSS feed, but found no trace of any vulnerability warning there. Is there another feed that provides this kind of essential upgrading information?

Quote from: kilroy at Nov 08, 2006, 02:55 AM

I will rework my link towards Modx using a different text and think it can be quite dangerous to have the default text along with the version used on a given website, if other vulnerabilities are advertised by websites like Secunia!

Especially when the guy (nuffsaid) report a vulnerability 3 days after it’s been patched (lol)
It would be funny if Secunia had not ignored our update (we’ve submitted the patch at least 5 times !!!) and link to the patch >:(
You’ll notice it stills display : "Solution Status: Unpatched"

Maybe they’re not happy with the fact they reported 3 days AFTER the patch

Quote from: kilroy

I have subscribed to the Modx blog RSS feed, but found no trace of any vulnerability warning there. Is there another feed that provides this kind of essential upgrading information?

Check the Security Notices board
You can also subscribe to email alerts

Check the Security Notices board
You can also subscribe to email alerts

Thanks!
Subscribed.

One last question (maybe should be posted on security issues)
is the 0.9.2.2 fix the same as the one described here: http://modxcms.com/forums/index.php/topic,8604.0.html

That was just a fast temporary patch for the existing exploit. The 0.9.2.2 upgrade/installation has a complete fix for the underlying problem so that it can’t be exploited at all by anybody.