Description
A security breach was reported on 21th november 2006, about a potential SQL injection in all Seditio and LDU versions.
A flaw in the code for the default avatar selection, coupled with a weirdness from a PHP function, allows an attacker to arbitrarily run a SQL query and change the password of the administrator and thus gain control of the whole site. For further reference, this issue is named "Avatar select hack".
How to fix Seditio (all versions)
If you can roll back to a backup :
- Restore the backup (SQL+files) with your account manager or ask the host's technical support.
- Download the Seditio package for your version : 110, 102, 101 or 100.
- Upload the new file /system/core/users/users.profile.inc.php to your webspace, only this one.
- It's done.
If you don't have a backup :
- You should consider having a host with backups, or making backups yourself.
- Rename datas/config.php to anything else to be sure your site is really off.
- Make a SQL backup with phpmyadmin.
- Download the Seditio package for your version : 110, 102, 101 or 100.
- Upload the new file /system/core/users/users.profile.inc.php to your webspace, only this one.
- With phpmyadmin, search function, look for the strings : "hack", "java", "refresh" and "meta" (without the quotes).
If you find anything suspicious, manually remove or clean, still with phpmyadmin.
- Then use this form to MD5 a string and set yourself a new pass, directly in the SQL, table sed_users, column user_password, your account (should be the first). As sample put the string "test" in the top box, press "Calculate hash", and copy/paste the resulting 32 chars string "d8e8fca2..." into the column user_password for your account.
- Do the same for all your members with administration rights.
- Still in the table sed_users, delete any recent user where user_maingrp=5 (not your own account of course).
- Disable Javascript in your browser.
- Rename datas/config.php back to put the site online.
- Log-in, disable the user registration from the config panel.
- In the userlist look at the last members if any managed to join an admin group by using your account.
If yes, delete the user.
- Make another SQL backup with phpmyadmin.
- Enable the user registration.
- Notice how it's noticably longer when you don't have backups.
- It should be done.
How to fix Land Down Under (all versions)
If you can roll back to a backup :
- Restore the backup (SQL+files) with your account manager or ask the host's technical support.
- Open the file /system/core/profile/profile.inc.php, find the string $avatar = $cfg['av_dir'].urldecode($id); and right below, add :
$avatar = str_replace("'","",$avatar);
$avatar = str_replace(",","",$avatar);
$avatar = str_replace(chr(0x00),"",$avatar);
Be sure to copy/paste, else it's easy to make typos.
Save the file, and upload to your webspace.
- It's done.
If you don't have a backup :
- You should consider having a host with backups, or making backups yourself.
- Rename datas/config.php to anything else to be sure your site is really off.
- Make a SQL backup with phpmyadmin.
- Open the file /system/core/profile/profile.inc.php, find the string $avatar = $cfg['av_dir'].urldecode($id); and right below, add :
$avatar = str_replace("'","",$avatar);
$avatar = str_replace(",","",$avatar);
$avatar = str_replace(chr(0x00),"",$avatar);
Be sure to copy/paste, else it's easy to make typos.
Save the file, and upload to your webspace.
- With phpmyadmin, search function, look for the strings : "hack", "java", "refresh" and "meta" (without the quotes).
If you find anything suspicious, manually remove or clean, still with phpmyadmin.
- Then use this form to MD5 a string and set yourself a new pass, directly in the SQL, table ldu_users, column user_password, your account (should be the first). As sample put the string "test" in the top box, press "Calculate hash", and copy/paste the resulting 32 chars string "d8e8fca2..." into the column user_password for your account.
- Do the same for all your members with administration rights.
- Still in the table ldu_users, delete any recent user where user_level is higher than 95 (not your own account of course).
- Run those queries with phpmyadmin, tab 'SQL' :
UPDATE ldu_config SET config_value=0 WHERE config_name='maintenance';
UPDATE ldu_config SET config_value='Upgrading' WHERE config_name='maintenance_reason'; -
- Disable Javascript in your browser.
- Rename datas/config.php back to put the site online.
- Log-in, disable the user registration from the config panel.
- In the userlist look at the last members if any managed to join an admin group by using your account.
If yes, delete the user.
- Make another SQL backup with phpmyadmin.
- Enable the user registration.
- Notice how it's noticably longer when you don't have backups.
- It should be done.
Hints and comments
- Don't bother trying to ban IPs, those people have way to much free time and they can use proxies.
- For Seditio, never put the migthy $cfg['allowphp_override'] = TRUE; in the config file if you don't REALLY need it.
- To avoid such wide spreads in the future, it is not required anymore to put you websites in your profile here at Neocrome.net
