Hi, I have many websites under Modx, mostly Evo 1.05 and 1.06.
Yesterday I have noticed high server load, examined and find that server is compromised (sending thousands of email messages from random names on few of my domains).
After little search I have found on 4 modx domains in /assets/images those files:
frm32212180t.php
frm98286973t.php
Heschedule.php
Pschedule.php
seobrmv.php
sslxFp.php
wp-conf.php
In access log files on compromised domains I have fond something disturbing:
31.133.35.55 - - [30/Jan/2013:05:34:43 +0100] "GET /website/manager/processors/login.processor.php?hash='+UNION+SELECT+1,1,1,'1&username=admin HTTP/1.1" 302 600 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E)"
attacker have easily accessed manager admin with url:
/website/manager/processors/login.processor.php?hash='+UNION+SELECT+1,1,1,'1&username=admin
or
/manager/processors/login.processor.php?hash='+UNION+SELECT+1,1,1,'1&username=admin
Could someone take a look is this a case on all MODx installations or is this just my case?
I will be online next 10 hours, so, if someone have a clue how to fix this, I will be more than thankful...I have 70 modx installations on this server...
Thanks,
Ivan Mandic
That URL rendered a 404 on one of my Evo 1.0.8 sites.
Upgrading right now...Thanks...
What's a difference between 1.05-6 and 1.08?
Can I just replace /manager folder or full install is necessary?
-
☆ A M B ☆
- 24,524 Posts
The only difference between 1.0.6 and 1.0.8 is the fix for the vulnerability. Replacing the /manager folder would be fine. Just make sure the config.inc.php file is safe.
Just tried 1.08 version on clean machine, same problem...
manager/processors/login.processor.php?hash='+UNION+SELECT+1,1,1,'1&username=admin grants full access to manager?
UPDATE: seems that everything is fine now, have no idea what happened, except that I have rebooted local router (router cache?)
[ed. note: respot last edited this post 13 years, 8 months ago.]
