Site Sucurity

Nuke Cadet Joined: Jul 19, 2004 Posts: 4

I have phpnuke 7.4 I uploaded the sucurity patch for it it all seems to be working ok.

This is what the patch has added.
This website is protected by: HackerAssassins™, Sentinel™, Admin Secure, Chatserv Patches, and more...

I typed in http://www.foo.bar/index.php?hackme=666 un/*hello world!*/ion%13%10%7fselect%20apple,bananas/**/from%08juice_authors

It works ok comes up and says you have been baned from site.

The prob I.am having is I added a new user this is a made up user I used it to see if email on registration was working ok with a yahoo email of mine. THis was just for a test to see if every thing was working ok.

Its been a couple months ago Every now and then I see somone is loged in as a member using this name.

I have Ocuri also I check it for the IP address and location from there I have to ban the IP.

If I remove the user from DB will this stop them from logging in as a member.

Do you have any idea how they would be doing this they would have to have got the password from my DB I guess.

Also I had some one loged in as a member with a name that is not in the user ID in DB.

I dont know if it is the same person are not the IP are deff but they may not be on a static IP.

Any Idea what I should do I guess they cant hurt anything they have not got into the admin panel just loged in as a member at this point.

This Is a community website nothing is locked for members its open for anyone right now.

The URL is http://www.rushvilleindiana.us

I just hate to have to go through putting site back up if who ever this is gets into admin are in the DB.

Thanks scott

Posted: Wed Aug 25, 2004 5:50 pm

if its just a dummy user you dont use then I would remove it.

Support Mod Joined: Feb 15, 2004 Posts: 806

scott45 wrote:

The prob I.am having is I added a new user this is a made up user I used it to see if email on registration was working ok with a yahoo email of mine. THis was just for a test to see if every thing was working ok.

Its been a couple months ago Every now and then I see somone is loged in as a member using this name.

I have Ocuri also I check it for the IP address and location from there I have to ban the IP.

If I remove the user from DB will this stop them from logging in as a member.

Try logging in as that "user" and change the password. Wait and see if they can still able to login again. Also check if this account logging in from different IP/location. Sometimes, this is caused by nothing but we forgot the account cookie still resides in different browser's that we were used. Smile

scott45 wrote:

Do you have any idea how they would be doing this they would have to have got the password from my DB I guess.

Another possibility, someone had stealing all your cookie informations. Even if this is far from my conclusion, but it's not impossible.

scott45 wrote:

Also I had some one loged in as a member with a name that is not in the user ID in DB.

I dont know if it is the same person are not the IP are deff but they may not be on a static IP.

Any Idea what I should do I guess they cant hurt anything they have not got into the admin panel just loged in as a member at this point.

Do not rely on block or module that displaying users who's logged in. I have no idea what addons or modules that can track user's session precisely but consider to put additional different blocks or modules that do the similar task, just for your comparion purposes.