Geeklog Forums

I'm not really sure what is happening to cause this. I run multiple sites of Geeklog on one machine. Today when I went to 2 of my sites I was unable to log in as admin or any other account. Upon close examination in phpmyadmin I noticed that the password string for every single account was the exact same. The string was different for both sites but all the accounts were the same.

Has anyone else experienced this? Is there something out there that can changed passwords "GLOBALLY"? To me it sounds like an attack and thankfully it was not on one of my sites that had a large membership but I fear it's only a matter of time.

It sure does. Probably an SQL injection.

Which version of Geeklog are you running? Which PHP and MySQL versions? Which plugins and other 3rd-party add-ons or scripts do you have on the site?

A good look through your webserver's logfiles (as well as Geeklog's error.log and access.log) may also reveal more information.

Feel free to post anything that you think is of interest to geeklog-security@lists.geeklog.net

bye, Dirk

GL 1.3.10
PHP 4.3.10
mySQL 4.0.12-nt

Good idea I haven't looked at the log files yet. And you know I'll post what I find.

Ron

The only thing that I can see that is odd is this

It looks like someone tried to use mysql statememts in comments. I could be wrong, what do you think.

Unfortunatly all my sites are using the same access, error and spamx log so it's kind of hard to tell what affects what site.

The comment functions are using proper parameter filtering. I don't see a way to inject something there.

I can see this error occuring when someone tries to post a comment as a response to a non-existent comment. Could have been a comment spammer or just someone trying out what happens in that case. Geeklog should really catch this ...

Anyway, that doesn't seem to have anything to do with the changed passwords. You didn't answer my question for other scripts you're running. Gallery and phpBB, to pick just two examples, had security updates recently (as did Geeklog, btw - 1.3.11 was also a security update for 1.3.10).

bye, Dirk

Guess I should go ahead and update to 1.3.11 as far as other scripts, no other scripts on either site. One site is my main business site and the other is a live test site that I set up to test different things and work on my shopping cart plugin. Here are the sites

http://www.isdsc.com (business site)
http://www.miplanet.com (test site)

Just a note, I have run across this before, it very well could be something that I am working on but to have something on one domain affect something on a different domain but not other domains or then same PC would be highly unlikely.

I will keep trying to figure out what is going on because it could be a serious issue.

Thanks Dirk,
Ron

Oh something I just thought about, I was testing Auditor. I'll check to see if that has anything to do with it.